ci-cd.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

# OIDC 토큰 요청 권한
permissions:
  id-token: write   # OIDC 토큰 요청용
  contents: read    # 코드 체크아웃용 (체크아웃 - Repo에 있는 코드를 Runner에 옮김)

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      # Step 1: 코드 가져오기
      - name: Checkout code
        uses: actions/checkout@v6

      # Step 2: 스프링 빌드를 위한 Java 21 설치
      - name: Setup Java 21
        uses: actions/setup-java@v5
        with:
          java-version: '21'
          distribution: 'corretto'

      # Step 3: Gradle 캐시
      - name: Cache Gradle packages
        uses: actions/cache@v5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      # Step 4: 테스트 실행
      - name: Run tests
        run: ./gradlew test

      # Step 5: JAR 빌드
      - name: Build JAR
        run: ./gradlew bootJar

      - name: Upload JAR artifact
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@v4
        with:
          name: application-jar
          path: build/libs/*.jar
          if-no-files-found: error

  publish:
    needs: build
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.vars.outputs.short_sha }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Download JAR artifact
        uses: actions/download-artifact@v4
        with:
          name: application-jar
          path: build/libs

      - name: Set short SHA
        id: vars
        run: echo "short_sha=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT

      # Step 1: AWS 자격증명 - OIDC
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      # Step 2: ECR 로그인
      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      # Step 3: Docker 빌드 및 push
      - name: Build and push Docker image
        run: |
          SHORT_SHA=${{ steps.vars.outputs.short_sha }}
          IMAGE_URI=${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/${{ vars.ECR_REPOSITORY }}

          # Docker 빌드 및 push
          docker build --platform linux/arm64 -t $IMAGE_URI:$SHORT_SHA .
          docker push $IMAGE_URI:$SHORT_SHA

          echo "✅ Pushed: $IMAGE_URI:$SHORT_SHA"

  deploy:
    needs: publish
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - name: API
            launch_template_id: ${{ vars.API_LAUNCH_TEMPLATE_ID }}
            asg_name: ${{ vars.API_ASG_NAME }}
            consumer_enabled: 'false'
          - name: Worker
            launch_template_id: ${{ vars.WORKER_LAUNCH_TEMPLATE_ID }}
            asg_name: ${{ vars.WORKER_ASG_NAME }}
            consumer_enabled: 'true'

    name: Deploy ${{ matrix.target.name }}

    steps:
      # Step 1: AWS 자격증명 - OIDC
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      # Step 2: Launch Template 새 버전 생성 (User Data의 IMAGE_TAG를 새 커밋 SHA로 교체)
      - name: Update ${{ matrix.target.name }} Launch Template
        env:
          IMAGE_TAG: ${{ needs.publish.outputs.image_tag }}
          AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }}
          AWS_REGION: ${{ vars.AWS_REGION }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          LAUNCH_TEMPLATE_ID: ${{ matrix.target.launch_template_id }}
          CONSUMER_ENABLED: ${{ matrix.target.consumer_enabled }}
        run: |
          ECR_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY}"

          USER_DATA=$(cat <<'USERDATA' | sed "s|__IMAGE_TAG__|${IMAGE_TAG}|g; s|__AWS_ACCOUNT_ID__|${AWS_ACCOUNT_ID}|g; s|__AWS_REGION__|${AWS_REGION}|g; s|__ECR_REPOSITORY__|${ECR_REPOSITORY}|g; s|__CONSUMER_ENABLED__|${CONSUMER_ENABLED}|g" | base64 -w 0
          #!/bin/bash
          set -e
          AWS_REGION="__AWS_REGION__"
          AWS_ACCOUNT_ID="__AWS_ACCOUNT_ID__"
          ECR_REPOSITORY="__ECR_REPOSITORY__"
          IMAGE_TAG="__IMAGE_TAG__"
          ECR_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY}"
          dnf update -y
          dnf install -y docker
          systemctl enable docker
          systemctl start docker
          aws ecr get-login-password --region ${AWS_REGION} | docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com
          docker pull ${ECR_URI}:${IMAGE_TAG}
          docker run -d -p 8080:8080 --restart unless-stopped --name ci-demo \
            -e SPRING_PROFILES_ACTIVE=prod \
            -e AWS_SQS_CONSUMER_ENABLED=__CONSUMER_ENABLED__ \
            ${ECR_URI}:${IMAGE_TAG}
          USERDATA
          )

          NEW_VERSION=$(aws ec2 create-launch-template-version \
            --launch-template-id ${LAUNCH_TEMPLATE_ID} \
            --source-version '$Latest' \
            --launch-template-data "{\"UserData\":\"${USER_DATA}\"}" \
            --query 'LaunchTemplateVersion.VersionNumber' \
            --output text)

          echo "✅ Launch Template v${NEW_VERSION} 생성 완료"

          aws ec2 modify-launch-template \
            --launch-template-id ${LAUNCH_TEMPLATE_ID} \
            --default-version ${NEW_VERSION}

          echo "✅ 기본 버전 → v${NEW_VERSION} 변경 완료"

      # Step 3: Instance Refresh 시작
      - name: Start ${{ matrix.target.name }} Instance Refresh
        id: refresh
        env:
          ASG_NAME: ${{ matrix.target.asg_name }}
        run: |
          REFRESH_ID=$(aws autoscaling start-instance-refresh \
            --auto-scaling-group-name ${ASG_NAME} \
            --preferences '{
              "MinHealthyPercentage": 100,
              "InstanceWarmup": 120
            }' \
            --query 'InstanceRefreshId' \
            --output text)

          echo "refresh_id=${REFRESH_ID}" >> $GITHUB_OUTPUT
          echo "✅ Instance Refresh 시작: ${REFRESH_ID}"

      # Step 4: Instance Refresh 완료 대기
      - name: Wait for ${{ matrix.target.name }} Instance Refresh
        env:
          ASG_NAME: ${{ matrix.target.asg_name }}
          REFRESH_ID: ${{ steps.refresh.outputs.refresh_id }}
        run: |
          echo "⏳ Instance Refresh 완료 대기 중..."

          for i in $(seq 1 30); do
            STATUS=$(aws autoscaling describe-instance-refreshes \
              --auto-scaling-group-name ${ASG_NAME} \
              --instance-refresh-ids ${REFRESH_ID} \
              --query 'InstanceRefreshes[0].Status' \
              --output text)

            echo "시도 ${i}/30 - 상태: ${STATUS}"

            if [ "${STATUS}" = "Successful" ]; then
              echo "✅ Instance Refresh 성공! 배포 완료!"
              exit 0
            elif [ "${STATUS}" = "Failed" ] || [ "${STATUS}" = "Cancelled" ]; then
              echo "❌ Instance Refresh 실패: ${STATUS}"
              exit 1
            fi

            sleep 30
          done

          echo "❌ Instance Refresh 타임아웃 (15분 초과)"
          exit 1