Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 36 additions & 21 deletions .github/workflows/cd_template.yaml
Original file line number Diff line number Diff line change
@@ -1,33 +1,48 @@
name: Deploy to cloudtype
name: Deploy EC2

on:
workflow_dispatch:
push:
branches:
- dev

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Connect deploy key
uses: cloudtype-github-actions/connect@v1
uses: actions/checkout@v4

- name: Set up JDK 17
uses: actions/setup-java@v4
with:
token: ${{ secrets.CLOUDTYPE_TOKEN }}
ghtoken: ${{ secrets.GHP_TOKEN }}
- name: Deploy
uses: cloudtype-github-actions/deploy@v1
java-version: '17'
distribution: 'corretto'

- name: Grant execute permission for gradlew
run: chmod +x ./gradlew

- name: gradlew bootJar
run: ./gradlew bootJar

- name: copy jar to server
uses: appleboy/scp-action@master
Comment on lines +28 to +29

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

appleboy/scp-action latest release GitHub

💡 Result:

The latest GitHub release of appleboy/scp-action is v1.0.0 (tag: v1.0.0), published Apr 27 (04:42) and marked Latest on the repo’s Releases page. [1]
GitHub Marketplace also shows the latest version as v1.0.0. [2]

Use in workflow: uses: appleboy/scp-action@v1 (or pin @v1.0.0). [2]

Sources: [1] [2]


appleboy/scp-action@master를 특정 버전으로 고정하세요.

@master를 사용하면 업스트림 변경이나 공급망 공격에 취약합니다. ssh-action은 특정 버전으로 고정되어 있으므로 scp-action도 동일하게 버전을 고정해야 합니다. 현재 최신 버전은 v1.0.0입니다.

제안
-        uses: appleboy/scp-action@master
+        uses: appleboy/scp-action@v1.0.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: copy jar to server
uses: appleboy/scp-action@master
- name: copy jar to server
uses: appleboy/scp-action@v1.0.0
🤖 Prompt for AI Agents
In @.github/workflows/cd_template.yaml around lines 28 - 29, The workflow uses
the GitHub Action reference appleboy/scp-action@master which is unsafe; update
that reference to a fixed release tag (e.g., appleboy/scp-action@v1.0.0) so the
step named "copy jar to server" pins to a specific, audited version instead of
`@master`.

with:
token: ${{ secrets.CLOUDTYPE_TOKEN }}
project: hyewon-0607/mse-project
stage: main
yaml: |
name: mse-project
app: java@17
options:
ports: 8080
context:
git:
url: git@github.com:${{ github.repository }}.git
ref: ${{ github.ref }}
preset: java-springboot
host: ${{ secrets.SSH_HOST }}
username: ec2-user
key: ${{ secrets.SSH_KEY }}
port: 22
source: "build/libs/*.jar"
target: "/home/ec2-user/app"
Comment on lines +35 to +36

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

SCP 전송 시 디렉토리 구조가 보존되어 파일 경로가 의도와 다릅니다.

appleboy/scp-action은 기본적으로 소스의 디렉토리 구조를 유지합니다. source: "build/libs/*.jar"로 전송하면 EC2에서 실제 경로가 /home/ec2-user/app/build/libs/mse-project.jar가 됩니다. strip_components 옵션을 사용하여 경로를 평탄화하세요.

제안
       - name: copy jar to server
-        uses: appleboy/scp-action@master
+        uses: appleboy/scp-action@v1.0.0
         with:
           host: ${{ secrets.SSH_HOST }}
           username: ec2-user
           key: ${{ secrets.SSH_KEY }}
           port: 22
           source: "build/libs/*.jar"
           target: "/home/ec2-user/app"
+          strip_components: 2
🤖 Prompt for AI Agents
In @.github/workflows/cd_template.yaml around lines 35 - 36, The SCP action
preserves source directories so using source: "build/libs/*.jar" places files
under /home/ec2-user/app/build/libs/..., fix by adding the strip_components
option for appleboy/scp-action (set strip_components: 2) to flatten the path so
the jar lands directly in the target directory; update the workflow block
containing the source/target keys to include strip_components: 2.


- name: Deploy with Docker Compose
uses: appleboy/ssh-action@v0.1.6
with:
host: ${{ secrets.SSH_HOST }}
username: ec2-user
key: ${{ secrets.SSH_KEY }}
port: 22
script: |
cd /home/ec2-user/app
docker-compose down
docker-compose up -d --build
Comment on lines +38 to +48

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

EC2에 docker-compose.yamlDockerfile이 전송되지 않아 배포가 실패합니다.

워크플로우는 JAR 파일만 EC2로 복사하지만, SSH 단계에서 docker-compose down / up --build를 실행합니다. docker-compose.yamlapp 서비스는 build: .을 사용하므로 EC2에 Dockerfiledocker-compose.yaml이 모두 필요합니다. 현재 이 파일들이 전송되지 않으므로 배포가 실패합니다.

해결 방안:

  1. 방법 A: docker-compose.yaml, Dockerfile, .env 등 필요한 파일도 함께 SCP로 전송
  2. 방법 B: EC2에서 docker-compose를 사용하지 않고 JAR를 직접 실행 (java -jar)
  3. 방법 C: Docker 이미지를 CI에서 빌드하여 레지스트리에 푸시하고, EC2에서 docker-compose pull로 배포
🤖 Prompt for AI Agents
In @.github/workflows/cd_template.yaml around lines 38 - 48, The deployment step
"Deploy with Docker Compose" currently runs docker-compose down/up but only the
JAR is copied to EC2, so transfer the missing artifacts or change the deployment
approach: either update the workflow to SCP (or use appleboy/scp-action) to copy
docker-compose.yaml, Dockerfile and .env to the EC2 app directory before the SSH
`script:` block; or replace the SSH `script:` commands to run the JAR directly
(e.g., `java -jar`) instead of docker-compose; or modify CI to build and push a
Docker image to a registry and change the SSH `script:` to `docker-compose pull`
and `docker-compose up -d` so EC2 doesn’t need source files. Ensure the chosen
fix updates the "script:" block and the preceding copy step so
docker-compose.yaml and Dockerfile are present on EC2 when `docker-compose up
--build` runs.

9 changes: 4 additions & 5 deletions .github/workflows/ci_template.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,8 @@ name: CI

# Event Trigger 특정 액션 (Push, Pull_Request)등이 명시한 Branch에서 일어나면 동작을 수행한다.
on:
push:
# 배열로 여러 브랜치를 넣을 수 있다.
branches: [ dev, feat/* ]
# push:
# branches: [ dev, feat/* ]
# github pull request 생성시
pull_request:
branches:
Expand All @@ -26,9 +25,9 @@ jobs:

# with은 plugin 파라미터 입니다. (java 17버전 셋업)
- name: java setup
uses: actions/setup-java@v2
uses: actions/setup-java@v4
with:
distribution: 'adopt' # See 'Supported distributions' for available options
distribution: 'corretto' # See 'Supported distributions' for available options
java-version: '17'

- name: make executable gradlew
Expand Down
8 changes: 8 additions & 0 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,14 @@ java {
}
}

bootJar {
archiveFileName = "mse-project.jar"
}

jar {
enabled = false
}

configurations {
compileOnly {
extendsFrom annotationProcessor
Expand Down
27 changes: 21 additions & 6 deletions docker-compose.yaml
Original file line number Diff line number Diff line change
@@ -1,22 +1,37 @@
version: "3"
version: "3.8"

services:
app:
build: .
container_name: mse-app
ports:
- "8080:8080"
environment:
SPRING_PROFILES_ACTIVE: docker
MYSQL_USER: ${MYSQL_USER}
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
depends_on:
- mysql
- redis

mysql:
image: mysql:latest
image: mysql:8.0
container_name: mse-mysql
ports:
- "23306:3306"
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
MYSQL_DATABASE: ${MYSQL_DATABASE}
MYSQL_USER: ${MYSQL_USER}
MYSQL_PASSWORD: ${MYSQL_PASSWORD}

Comment on lines 17 to +27

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

MySQL 데이터 영속성을 위한 볼륨이 없습니다.

docker-compose down 또는 컨테이너 재생성 시 MySQL 데이터가 모두 삭제됩니다. CD 워크플로우에서 매 배포마다 docker-compose downup --build를 실행하므로 배포할 때마다 DB가 초기화됩니다.

제안: 볼륨 추가
   mysql:
     image: mysql:8.0
     container_name: mse-mysql
     ports:
       - "23306:3306"
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
       MYSQL_DATABASE: ${MYSQL_DATABASE}
       MYSQL_USER: ${MYSQL_USER}
       MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+    volumes:
+      - mysql-data:/var/lib/mysql
+
+volumes:
+  mysql-data:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
mysql:
image: mysql:latest
image: mysql:8.0
container_name: mse-mysql
ports:
- "23306:3306"
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
MYSQL_DATABASE: ${MYSQL_DATABASE}
MYSQL_USER: ${MYSQL_USER}
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
mysql:
image: mysql:8.0
container_name: mse-mysql
ports:
- "23306:3306"
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
MYSQL_DATABASE: ${MYSQL_DATABASE}
MYSQL_USER: ${MYSQL_USER}
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
volumes:
- mysql-data:/var/lib/mysql
volumes:
mysql-data:
🤖 Prompt for AI Agents
In `@docker-compose.yaml` around lines 17 - 27, The MySQL service (service name
"mysql", container_name "mse-mysql") lacks a persistent volume so its data is
lost on recreate; add a named volume (e.g., "mysql_data") and mount it to the
container MySQL data dir (/var/lib/mysql) by adding a volumes: entry under the
mysql service (e.g., volumes: - mysql_data:/var/lib/mysql) and declare the named
volume at the top-level volumes: section (e.g., mysql_data: {}), ensuring Docker
persists DB files across docker-compose down/up cycles.

redis:
image: redis:latest
image: redis:7
container_name: mse-redis
ports:
- "26379:6379"

nginx:
image: nginx:latest
ports:
- "80:80"
depends_on:
- redis
- mysql
2 changes: 1 addition & 1 deletion src/main/resources/application-docker.properties
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# MySQL
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://mysql:23306/mse_db
spring.datasource.url=jdbc:mysql://mysql:3306/mse_db

# DB certification
spring.datasource.username=${MYSQL_USER}
Expand Down
6 changes: 6 additions & 0 deletions src/main/resources/application-local.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# certification
spring.config.import=optional:application-local-secret.properties

# MySQL
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/mse_db
4 changes: 2 additions & 2 deletions src/main/resources/application.properties
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
spring.application.name=mse_project
spring.profiles.active=local
#spring.profiles.active=local

# Session
server.servlet.session.timeout=60m
Expand All @@ -10,4 +10,4 @@ spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQLDialect
spring.jpa.properties.hibernate.format_sql=true
spring.jpa.show-sql=true
logging.level.org.hibernate.SQL=debug
logging.level.org.hibernate.type.descriptor.sql.BasicBinder=trace
logging.level.org.hibernate.type.descriptor.sql.BasicBinder=trace
2 changes: 2 additions & 0 deletions src/test/java/com/mse_project/MseProjectApplicationTests.java
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,10 @@

import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.ActiveProfiles;

@SpringBootTest
@ActiveProfiles("test")
class MseProjectApplicationTests {

@Test
Expand Down