deploy-dev.yml

name: CD to EC2 via Docker Hub

## dev 브랜치 변경 감지시 동작
on:
  push:
    branches: [ "dev" ]

permissions:
  contents: read


jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Github Repository 파일 불러오기
        uses: actions/checkout@v4

      - name: JDK 21 버전 설정
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - name: 빌드 시간 단축용 gradle 캐싱
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: FCM 비공개 키 파일 생성
        env:
          JSON_SECRET: ${{ secrets.FIREBASE_PRIVATE_KEY_JSON_BASE64_ENCODED }}
          JSON_DIR: src/main/resources
          JSON_FILE_NAME: refood-firebase-private-key.json
        run: echo $JSON_SECRET | base64 --decode > $JSON_DIR/$JSON_FILE_NAME

      - name: Gradlew 권한 부여
        run: chmod +x gradlew
      - name: Gradle 빌드
        run: ./gradlew bootJar

      - name: 도커 이미지 생성 및 도커 허브 Push
        run: |
          docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
          docker compose -f docker-compose.yml build
          docker tag refood-server ${{ secrets.DOCKER_USERNAME }}/refood-server:${GITHUB_SHA::7}
          docker push ${{ secrets.DOCKER_USERNAME }}/refood-server:${GITHUB_SHA::7}

      - name: 도커 허브 Pull 및 서버 실행
        uses: appleboy/ssh-action@master
        ## 서버 환경변수 설정
        env:
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          JWT_ACCESS_TOKEN_EXPIRATION: ${{ secrets.JWT_ACCESS_TOKEN_EXPIRATION }}
          JWT_REFRESH_TOKEN_EXPIRATION: ${{ secrets.JWT_REFRESH_TOKEN_EXPIRATION }}
          KAKAO_CLIENT_ID: ${{ secrets.KAKAO_CLIENT_ID }}
          KAKAO_CLIENT_SECRET: ${{ secrets.KAKAO_CLIENT_SECRET }}
          KAKAO_REST_API_KEY: ${{ secrets.KAKAO_REST_API_KEY }}
          KAKAO_GEO_API_KEY: ${{ secrets.KAKAO_GEO_API_KEY }}
          MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
          MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
          BUSINESS_APPROVAL_BASE_URL: ${{ secrets.BUSINESS_APPROVAL_BASE_URL }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          AWS_IAM_ACCESS_KEY: ${{ secrets.AWS_IAM_ACCESS_KEY }}
          AWS_IAM_SECRET_KEY: ${{ secrets.AWS_IAM_SECRET_KEY }}
          AWS_RDS_URL: ${{ secrets.AWS_RDS_URL }}
          AWS_RDS_USERNAME: ${{ secrets.AWS_RDS_USERNAME }}
          AWS_RDS_PASSWORD: ${{ secrets.AWS_RDS_PASSWORD }}
          REDIS_HOST: ${{ secrets.REDIS_HOST }}
          REDIS_PORT: ${{ secrets.REDIS_PORT }}
          TOSS_PAYMENT_SECRET_KEY: ${{ secrets.TOSS_PAYMENT_SECRET_KEY }}
          TOSS_PAYMENT_BASE_URL: ${{ secrets.TOSS_PAYMENT_BASE_URL }}
        with:
          host: ${{ secrets.AWS_EC2_PUBLIC_IP }}
          username: ubuntu
          key: ${{ secrets.AWS_EC2_PEM_KEY }}
          envs: GITHUB_SHA,JWT_SECRET,JWT_ACCESS_TOKEN_EXPIRATION,JWT_REFRESH_TOKEN_EXPIRATION,KAKAO_CLIENT_ID,KAKAO_CLIENT_SECRET,KAKAO_REST_API_KEY,KAKAO_GEO_API_KEY,MAIL_USERNAME,MAIL_PASSWORD,BUSINESS_APPROVAL_BASE_URL,AWS_REGION,AWS_S3_BUCKET,AWS_IAM_ACCESS_KEY,AWS_IAM_SECRET_KEY,AWS_RDS_URL,AWS_RDS_USERNAME,AWS_RDS_PASSWORD, REDIS_HOST, REDIS_PORT, TOSS_PAYMENT_SECRET_KEY, TOSS_PAYMENT_BASE_URL
          script: |
            set -euo pipefail
            
            docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}            
            docker pull ${{ secrets.DOCKER_USERNAME }}/refood-server:${GITHUB_SHA::7}
            docker tag ${{ secrets.DOCKER_USERNAME }}/refood-server:${GITHUB_SHA::7} refood-server

            ## .env 작성
            mkdir -p /home/ubuntu/app
            cat > /home/ubuntu/app/.env <<EOF
            JWT_SECRET=${JWT_SECRET}
            JWT_ACCESS_TOKEN_EXPIRATION=${JWT_ACCESS_TOKEN_EXPIRATION}
            JWT_REFRESH_TOKEN_EXPIRATION=${JWT_REFRESH_TOKEN_EXPIRATION}
            KAKAO_CLIENT_ID=${KAKAO_CLIENT_ID}
            KAKAO_CLIENT_SECRET=${KAKAO_CLIENT_SECRET}
            KAKAO_REST_API_KEY=${KAKAO_REST_API_KEY}
            KAKAO_GEO_API_KEY=${KAKAO_GEO_API_KEY}
            MAIL_USERNAME=${MAIL_USERNAME}
            MAIL_PASSWORD=${MAIL_PASSWORD}
            BUSINESS_APPROVAL_BASE_URL=${BUSINESS_APPROVAL_BASE_URL}
            AWS_REGION=${AWS_REGION}
            AWS_S3_BUCKET=${AWS_S3_BUCKET}
            AWS_IAM_ACCESS_KEY=${AWS_IAM_ACCESS_KEY}
            AWS_IAM_SECRET_KEY=${AWS_IAM_SECRET_KEY}
            AWS_RDS_URL=${AWS_RDS_URL}
            AWS_RDS_USERNAME=${AWS_RDS_USERNAME}
            AWS_RDS_PASSWORD=${AWS_RDS_PASSWORD}
            REDIS_HOST=${REDIS_HOST}
            REDIS_PORT=${REDIS_PORT}
            TOSS_PAYMENT_SECRET_KEY=${TOSS_PAYMENT_SECRET_KEY}
            TOSS_PAYMENT_BASE_URL=${TOSS_PAYMENT_BASE_URL}
            EOF
            
            docker rm -f server || true
            docker rm -f redis || true
            
            ## 서버-redis 컨테이너간 네트워크 생성
            docker network inspect appnet >/dev/null 2>&1 || docker network create appnet
            
            ## redis 컨테이너 실행
            docker run --rm -d --name redis \
              --network appnet \
              -v /srv/refood/redis-data:/data \
              redis:7-alpine \
              redis-server --appendonly yes
            
            ## server 컨테이너 실행
            docker run --rm -d --name server \
              --network appnet \
              --env-file /home/ubuntu/app/.env \
              -e TZ=Asia/Seoul \
              -p 8080:8080 \
              refood-server

            ## 서버 & 레디스 헬스 체크 (5초 대기 후 시작)
            TARGET_URL=localhost PORT=8080
            
            echo "> Waiting WAS for 5 seconds..."
            sleep 5
            
            code=$(curl -sS --retry 15 --retry-delay 6 --retry-connrefused --retry-all-errors \
                    -m 3 --connect-timeout 2 -o /dev/null -w "%{http_code}" \
                    $TARGET_URL:$PORT/health || true)
            echo "> last http_code=$code"

            if [ "$code" = "200" ]; then
              echo "> New WAS successfully running"
            else
              echo "> Server health check failed."
              exit 1
            fi
            
            pong=$(docker exec redis redis-cli ping)
            echo "> redis ping=$pong"
            
            if [ "$pong" = "PONG" ]; then
              echo "> Redis is healthy"
            else
              echo "> Redis health check failed."
              exit 1
            fi