ci-cd.yml

name: CI/CD

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test-build:
    name: test-build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency:
      group: ci-${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Set up Java
        uses: actions/setup-java@v5.6.0
        with:
          distribution: temurin
          java-version: "26"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6.2.0

      - name: Test and build
        run: ./gradlew clean test bootJar --no-daemon

      - name: Prepare deployment artifact
        run: |
          set -euo pipefail
          jar_path=$(find build/libs -maxdepth 1 -type f -name '*.jar' ! -name '*-plain.jar' -print -quit)
          test -n "$jar_path"
          install -m 600 "$jar_path" "$RUNNER_TEMP/app.jar"
          (
            cd "$RUNNER_TEMP"
            sha256sum app.jar > app.jar.sha256
          )

      - name: Validate production image
        run: |
          set -euo pipefail
          docker build \
            --file deploy/Dockerfile.prebuilt \
            --tag ject-checkin-server:ci \
            "$RUNNER_TEMP"

      - name: Upload deployment artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v7.0.1
        with:
          name: production-app-${{ github.sha }}
          path: |
            ${{ runner.temp }}/app.jar
            ${{ runner.temp }}/app.jar.sha256
          if-no-files-found: error
          retention-days: 1

  deploy:
    name: deploy-production
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    needs:
      - test-build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: production
    concurrency:
      group: production-deploy
      cancel-in-progress: false
    steps:
      - name: Download deployment artifact
        uses: actions/download-artifact@v8.0.1
        with:
          name: production-app-${{ github.sha }}
          path: ${{ runner.temp }}/deployment

      - name: Configure SSH
        env:
          LIGHTSAIL_SSH_PRIVATE_KEY: ${{ secrets.LIGHTSAIL_SSH_PRIVATE_KEY }}
          LIGHTSAIL_KNOWN_HOSTS: ${{ secrets.LIGHTSAIL_KNOWN_HOSTS }}
        run: |
          set -euo pipefail
          install -d -m 700 "$HOME/.ssh"
          printf '%s\n' "$LIGHTSAIL_SSH_PRIVATE_KEY" > "$HOME/.ssh/ject-deploy"
          printf '%s\n' "$LIGHTSAIL_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/ject-deploy" "$HOME/.ssh/known_hosts"

      - name: Upload application
        env:
          LIGHTSAIL_HOST: ${{ secrets.LIGHTSAIL_HOST }}
          LIGHTSAIL_USER: ${{ secrets.LIGHTSAIL_USER }}
        run: |
          set -euo pipefail
          scp \
            -i "$HOME/.ssh/ject-deploy" \
            -o BatchMode=yes \
            "$RUNNER_TEMP/deployment/app.jar" \
            "$RUNNER_TEMP/deployment/app.jar.sha256" \
            "$LIGHTSAIL_USER@$LIGHTSAIL_HOST:/home/deploy/incoming/"

      - name: Deploy and verify
        env:
          LIGHTSAIL_HOST: ${{ secrets.LIGHTSAIL_HOST }}
          LIGHTSAIL_USER: ${{ secrets.LIGHTSAIL_USER }}
        run: |
          set -euo pipefail
          ssh \
            -i "$HOME/.ssh/ject-deploy" \
            -o BatchMode=yes \
            "$LIGHTSAIL_USER@$LIGHTSAIL_HOST" \
            "sudo /usr/local/sbin/ject-checkin-deploy"
          curl \
            --fail \
            --silent \
            --show-error \
            --retry 6 \
            --retry-delay 5 \
            --retry-all-errors \
            https://checkin-api.ject.kr/actuator/health

  notify:
    name: notify-discord
    if: always() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    needs:
      - test-build
      - deploy
    runs-on: ubuntu-latest
    timeout-minutes: 5
    environment: production
    steps:
      - name: Send deployment result
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          TEST_RESULT: ${{ needs.test-build.result }}
          DEPLOY_RESULT: ${{ needs.deploy.result }}
          COMMIT_SHA: ${{ github.sha }}
          ACTOR: ${{ github.actor }}
          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          translate_result() {
            case "$1" in
              success) printf '성공' ;;
              failure) printf '실패' ;;
              cancelled) printf '취소됨' ;;
              skipped) printf '건너뜀' ;;
              *) printf '%s' "$1" ;;
            esac
          }

          if [[ "$TEST_RESULT" == "success" && "$DEPLOY_RESULT" == "success" ]]; then
            title="운영 서버 배포 성공"
            color=3066993
          else
            title="운영 서버 배포 실패"
            color=15158332
          fi
          test_label=$(translate_result "$TEST_RESULT")
          deploy_label=$(translate_result "$DEPLOY_RESULT")

          payload=$(jq -n \
            --arg title "$title" \
            --arg test "$test_label" \
            --arg deploy "$deploy_label" \
            --arg sha "${COMMIT_SHA:0:12}" \
            --arg actor "$ACTOR" \
            --arg url "$RUN_URL" \
            --argjson color "$color" \
            '{
              embeds: [{
                title: $title,
                color: $color,
                fields: [
                  {name: "테스트/빌드", value: $test, inline: true},
                  {name: "배포", value: $deploy, inline: true},
                  {name: "커밋", value: $sha, inline: true},
                  {name: "실행자", value: $actor, inline: true}
                ],
                url: $url
              }]
            }')

          curl \
            --fail \
            --silent \
            --show-error \
            --header "Content-Type: application/json" \
            --data "$payload" \
            "$DISCORD_WEBHOOK_URL"