deploy.yml

name: Deploy to Amazon ECS and EC2

on:
  push:
    branches: [ "main", "develop" ]

env:
  AWS_REGION: ap-northeast-2
  ECR_REPOSITORY: only4-deploy

  # ECS 템플릿 파일명
  SETTLEMENT_TEMPLATE: task-settlement.json
  NOTIFICATION_TEMPLATE: task-notification.json

  # ECS 렌더링 결과 파일명 (임시 생성됨)
  SETTLEMENT_TASK_DEF: settlement-rendered.json
  NOTIFICATION_TASK_DEF: notification-rendered.json

  # JSON 내 containerDefinitions에 정의된 name과 반드시 일치해야 함
  SETTLEMENT_CONTAINER_NAME: settlement-container
  NOTIFICATION_CONTAINER_NAME: notification-container

permissions:
  contents: read

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Convert gradlew line endings
        run: sed -i 's/\r$//' gradlew

      - name: Build with Gradle
        run: ./gradlew clean build -x test

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

      # ----------------------------------------------------------------
      # 1. ECS 배포 단계 (Settlement & Notification 분리)
      # ----------------------------------------------------------------

      # [정산 배치]
      - name: Render Settlement Task Definition
        id: render-settlement
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ env.SETTLEMENT_TEMPLATE }}
          container-name: ${{ env.SETTLEMENT_CONTAINER_NAME }}
          image: ${{ steps.build-image.outputs.image }}
          environment-variables: |
            PROD_DB_URL=${{ secrets.PROD_DB_URL }}
            PROD_DB=${{ secrets.PROD_DB }}
            PROD_DB_USER=${{ secrets.PROD_DB_USER }}
            PROD_DB_PASSWORD=${{ secrets.PROD_DB_PASSWORD }}
            PROD_KAFKA_URL=${{ secrets.PROD_KAFKA_URL }}
            KAFKA_GROUP_ID=${{ secrets.KAFKA_GROUP_ID }}
            BATCH_SIZE=${{ secrets.BATCH_SIZE }}
            DEFAULT_BATCH_FETCH_SIZE=${{ secrets.DEFAULT_BATCH_FETCH_SIZE }}
            KAFKA_EMAIL_REQUEST=${{ secrets.KAFKA_EMAIL_REQUEST }}
            EMAIL_MAX_ATTEMPTS=${{ secrets.EMAIL_MAX_ATTEMPTS }}
            INITIAL_INTERVAL_MS=${{ secrets.INITIAL_INTERVAL_MS }}
            MAX_INTERVAL_MS=${{ secrets.MAX_INTERVAL_MS }}
            SETTLEMENT_MIN=${{ secrets.SETTLEMENT_MIN }}
            SETTLEMENT_MAX=${{ secrets.SETTLEMENT_MAX }}
            ECS_CLUSTER=${{ secrets.ECS_CLUSTER }}
            AWS_REGION=${{ env.AWS_REGION }}
            ECS_SUBNET_IDS=${{ secrets.ECS_SUBNET_IDS }}
            ECS_SECURITY_GROUP_IDS=${{ secrets.ECS_SECURITY_GROUP_IDS }}
            AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID }}
            SCHEDULER_EXECUTION_ROLE_ARN=${{ secrets.SCHEDULER_EXECUTION_ROLE_ARN }}
            JAVA_OPTS=${{ secrets.JAVA_OPTS }}


      - name: Register Settlement Task Definition
        run: |
          sed -i "s|ECS_TASK_EXECUTION_ROLE_ARN|${{ secrets.ECS_TASK_EXECUTION_ROLE_ARN }}|g" ${{ steps.render-settlement.outputs.task-definition }}
          sed -i "s|ECS_TASK_ROLE_ARN|${{ secrets.ECS_TASK_ROLE_ARN }}|g" ${{ steps.render-settlement.outputs.task-definition }}
          aws ecs register-task-definition --cli-input-json file://${{ steps.render-settlement.outputs.task-definition }}

      # [발송 배치]
      - name: Render Notification Task Definition
        id: render-notification
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ env.NOTIFICATION_TEMPLATE }}
          container-name: ${{ env.NOTIFICATION_CONTAINER_NAME }}
          image: ${{ steps.build-image.outputs.image }}
          environment-variables: |
            PROD_DB_URL=${{ secrets.PROD_DB_URL }}
            PROD_DB=${{ secrets.PROD_DB }}
            PROD_DB_USER=${{ secrets.PROD_DB_USER }}
            PROD_DB_PASSWORD=${{ secrets.PROD_DB_PASSWORD }}
            PROD_KAFKA_URL=${{ secrets.PROD_KAFKA_URL }}
            KAFKA_GROUP_ID=${{ secrets.KAFKA_GROUP_ID }}
            BATCH_SIZE=${{ secrets.BATCH_SIZE }}
            DEFAULT_BATCH_FETCH_SIZE=${{ secrets.DEFAULT_BATCH_FETCH_SIZE }}
            KAFKA_EMAIL_REQUEST=${{ secrets.KAFKA_EMAIL_REQUEST }}
            KAFKA_PARTITIONS=${{ secrets.KAFKA_PARTITIONS }}
            EMAIL_MAX_ATTEMPTS=${{ secrets.EMAIL_MAX_ATTEMPTS }}
            INITIAL_INTERVAL_MS=${{ secrets.INITIAL_INTERVAL_MS }}
            MAX_INTERVAL_MS=${{ secrets.MAX_INTERVAL_MS }}
            ECS_CLUSTER=${{ secrets.ECS_CLUSTER }}
            AWS_REGION=${{ env.AWS_REGION }}
            ECS_SUBNET_IDS=${{ secrets.ECS_SUBNET_IDS }}
            ECS_SECURITY_GROUP_IDS=${{ secrets.ECS_SECURITY_GROUP_IDS }}
            AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID }}
            SCHEDULER_EXECUTION_ROLE_ARN=${{ secrets.SCHEDULER_EXECUTION_ROLE_ARN }}
            JAVA_OPTS=${{ secrets.JAVA_OPTS }}

      - name: Register Notification Task Definition
        run: |
          sed -i "s|ECS_TASK_EXECUTION_ROLE_ARN|${{ secrets.ECS_TASK_EXECUTION_ROLE_ARN }}|g" ${{ steps.render-notification.outputs.task-definition }}
          sed -i "s|ECS_TASK_ROLE_ARN|${{ secrets.ECS_TASK_ROLE_ARN }}|g" ${{ steps.render-notification.outputs.task-definition }}
          aws ecs register-task-definition --cli-input-json file://${{ steps.render-notification.outputs.task-definition }}

      # ----------------------------------------------------------------
      # 2. EC2 배포 단계 (API Server)
      # ----------------------------------------------------------------

      - name: Create app directory if not exists
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          port: 22
          script: mkdir -p /home/${{ secrets.EC2_USERNAME }}/app

      - name: Copy Docker Compose file to EC2
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          port: 22
          source: "docker-compose-prod.yml"
          target: "/home/${{ secrets.EC2_USERNAME }}/app"

      - name: Deploy to EC2
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          port: 22
          script: |
            sudo systemctl start docker || true
            
            mkdir -p /home/${{ secrets.EC2_USERNAME }}/app
            sudo chown -R ${{ secrets.EC2_USERNAME }}: /home/${{ secrets.EC2_USERNAME }}/app
            cd /home/${{ secrets.EC2_USERNAME }}/app
            
            rm -f .env
            cat <<EOF > .env
            SPRING_PROFILES_ACTIVE=prod
            SPRING_BATCH_JOB_NAME=${{ secrets.SPRING_BATCH_JOB_NAME }}
            SPRING_BATCH_JOB_ENABLED=${{ secrets.SPRING_BATCH_JOB_ENABLED }}
            ECR_REGISTRY=${{ steps.login-ecr.outputs.registry }}
            IMAGE_TAG=${{ github.sha }}
            PROD_DB_URL=${{ secrets.PROD_DB_URL }}
            PROD_DB=${{ secrets.PROD_DB }}
            PROD_DB_USER=${{ secrets.PROD_DB_USER }}
            PROD_DB_PASSWORD=${{ secrets.PROD_DB_PASSWORD }}
            PROD_KAFKA_URL=${{ secrets.PROD_KAFKA_URL }}
            DEFAULT_BATCH_FETCH_SIZE=${{ secrets.DEFAULT_BATCH_FETCH_SIZE }}
            BATCH_SIZE=${{ secrets.BATCH_SIZE }}
            KAFKA_GROUP_ID=${{ secrets.KAFKA_GROUP_ID }}
            KAFKA_EMAIL_REQUEST=${{ secrets.KAFKA_EMAIL_REQUEST }}
            EMAIL_MAX_ATTEMPTS=${{ secrets.EMAIL_MAX_ATTEMPTS }}
            INITIAL_INTERVAL_MS=${{ secrets.INITIAL_INTERVAL_MS }}
            MAX_INTERVAL_MS=${{ secrets.MAX_INTERVAL_MS }}
            SETTLEMENT_MIN=${{ secrets.SETTLEMENT_MIN }}
            SETTLEMENT_MAX=${{ secrets.SETTLEMENT_MAX }}
            ECS_CLUSTER=${{ secrets.ECS_CLUSTER }}
            ECS_SUBNET_IDS=${{ secrets.ECS_SUBNET_IDS }}
            ECS_SECURITY_GROUP_IDS=${{ secrets.ECS_SECURITY_GROUP_IDS }}
            AWS_ACCOUNT_ID=${{ secrets.AWS_ACCOUNT_ID }}
            SCHEDULER_EXECUTION_ROLE_ARN=${{ secrets.SCHEDULER_EXECUTION_ROLE_ARN }}
            CORS_ALLOWED_ORIGINS=${{ secrets.CORS_ALLOWED_ORIGINS }}
            EOF
            
            aws ecr get-login-password --region ${{ env.AWS_REGION }} | docker login --username AWS --password-stdin ${{ steps.login-ecr.outputs.registry }}
            
            docker compose -f docker-compose-prod.yml down || true
            docker compose -f docker-compose-prod.yml pull
            docker compose -f docker-compose-prod.yml up -d
            
            docker image prune -f