Skip to content

[FEAT] #70: dev, prod 환경 분리 #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kaswhy merged 5 commits into from
Aug 23, 2025
Merged

[FEAT] #70: dev, prod 환경 분리 #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
68d51cd
feat(#70/*): dev, prod 환경 분리
kaswhy Aug 23, 2025
cb5b763
feat(#70/*): dozzle 설정 추가
kaswhy Aug 23, 2025
50c9766
fix(#70/.github): dev 환경 db 이름 오타 수정 및 actions 버전 수정
kaswhy Aug 23, 2025
07af7ff
fix(#70/.github): appspec.yml 이름 오류 수정
kaswhy Aug 23, 2025
eb7e676
fix(#70/.github): docker-compose 지정
kaswhy Aug 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 74 additions & 0 deletions .github/workflows/deploy-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
name: CD - DEV
Copy link

@coderabbitai coderabbitai bot Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

OIDC 사용 시 워크플로우 permissions 선언 필요.

OIDC 토큰 발급을 위해 id-token: write 권한이 필요합니다.

다음 블록을 워크플로우 루트에 추가하세요(파일 상단 근처).

permissions:
  id-token: write
  contents: read
🤖 Prompt for AI Agents 
.github/workflows/deploy-dev.yml around lines 1 to 1: The workflow lacks a
permissions block required for OIDC token issuance; add a top-level permissions
declaration near the top of the file with id-token: write and contents: read so
the runner can request OIDC tokens and read repository contents. Ensure the
permissions block is placed at the workflow root (not inside a job or step) and
uses top-level YAML keys.


on:
push:
branches:
- main

jobs:
build-and-deploy:
runs-on: ubuntu-latest

steps:
- name: Checkout Repository
uses: actions/checkout@v4

- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

- name: Build and Push Docker Image
run: |
docker build -t ${{ secrets.DOCKER_HUB_USERNAME }}/gdgoc-be-app-dev:latest .
docker push ${{ secrets.DOCKER_HUB_USERNAME }}/gdgoc-be-app-dev:latest
- name: move files to Root
run: |
cp gdgoc/docker-compose-dev.yml ./docker-compose-dev.yml
cp gdgoc/deploy.dev.sh ./deploy.dev.sh
cp gdgoc/appspec.dev.yml ./appspec.yml
- name: Create Deployment Package
run: |
echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" > .env
echo "DB_HOST=${{ secrets.DB_HOST }}" >> .env
echo "DB_PORT=${{ secrets.DB_PORT }}" >> .env
echo "DB_NAME_DEV=${{ secrets.DB_NAME_DEV }}" >> .env
echo "DB_USERNAME=${{ secrets.DB_USERNAME }}" >> .env
echo "DB_PASSWORD=${{ secrets.DB_PASSWORD }}" >> .env
echo "GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}" >> .env
echo "GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}" >> .env
echo "GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }}" >> .env
echo "GOOGLE_ISSUER=${{secrets.GOOGLE_ISSUER}}" >> .env
echo "SELF_ISSUER=${{secrets.SELF_ISSUER}}" >> .env
echo "SECRET_KEY=${{secrets.SECRET_KEY}}" >> .env
echo "AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }}" >> .env
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}" >> .env
echo "AWS_REGION=${{ secrets.AWS_REGION }}" >> .env
echo "AWS_RESOURCE_BUCKET=${{secrets.AWS_RESOURCE_BUCKET}}" >> .env
echo "AWS_TEST_RESOURCE_BUCKET=${{secrets.AWS_TEST_RESOURCE_BUCKET}}" >> .env
echo "GMAIL=${{secrets.GMAIL}}" >> .env
echo "GMAIL_PASSWORD=${{secrets.GMAIL_PASSWORD}}" >> .env
echo "DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}" >> .env
echo "DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}" >> .env
Comment on lines +33 to +55
Copy link

@coderabbitai coderabbitai bot Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

.env 작성 방식 개선(따옴표/공백/SC2129).

여러 번의 echo >> 리다이렉트는 ShellCheck SC2129 경고를 유발하고, 값에 공백/특수문자가 있을 때 깨질 수 있습니다. Here‑doc으로 원자적으로 기록하세요. 또한 deploy 스크립트 실행 권한을 패키징 전에 보장하세요.

-          echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" > .env
-          echo "DB_HOST=${{ secrets.DB_HOST }}" >> .env 
-          echo "DB_PORT=${{ secrets.DB_PORT }}" >> .env
-          echo "DB_NAME_DEV=${{ secrets.DB_NAME_DEV }}" >> .env
-          echo "DB_USERNAME=${{ secrets.DB_USERNAME }}" >> .env
-          echo "DB_PASSWORD=${{ secrets.DB_PASSWORD }}" >> .env
-          echo "GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}" >> .env
-          echo "GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}" >> .env
-          echo "GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }}" >> .env
-          echo "GOOGLE_ISSUER=${{secrets.GOOGLE_ISSUER}}" >> .env
-          echo "SELF_ISSUER=${{secrets.SELF_ISSUER}}" >> .env
-          echo "SECRET_KEY=${{secrets.SECRET_KEY}}" >> .env
-          echo "AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }}" >> .env
-          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}" >> .env
-          echo "AWS_REGION=${{ secrets.AWS_REGION }}" >> .env
-          echo "AWS_RESOURCE_BUCKET=${{secrets.AWS_RESOURCE_BUCKET}}" >> .env
-          echo "AWS_TEST_RESOURCE_BUCKET=${{secrets.AWS_TEST_RESOURCE_BUCKET}}" >> .env
-          echo "GMAIL=${{secrets.GMAIL}}" >> .env
-          echo "GMAIL_PASSWORD=${{secrets.GMAIL_PASSWORD}}" >> .env
-          echo "DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}" >> .env
-          echo "DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}" >> .env
+          cat > .env <<'EOF'
+          DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}
+          DB_HOST=${{ secrets.DB_HOST }}
+          DB_PORT=${{ secrets.DB_PORT }}
+          DB_NAME_DEV=${{ secrets.DB_NAME_DEV }}
+          DB_USERNAME=${{ secrets.DB_USERNAME }}
+          DB_PASSWORD=${{ secrets.DB_PASSWORD }}
+          GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}
+          GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }}
+          GOOGLE_ISSUER=${{ secrets.GOOGLE_ISSUER }}
+          SELF_ISSUER=${{ secrets.SELF_ISSUER }}
+          SECRET_KEY=${{ secrets.SECRET_KEY }}
+          # AWS credentials are intentionally omitted; use role/OIDC at runtime
+          AWS_REGION=${{ secrets.AWS_REGION }}
+          AWS_RESOURCE_BUCKET=${{ secrets.AWS_RESOURCE_BUCKET }}
+          AWS_TEST_RESOURCE_BUCKET=${{ secrets.AWS_TEST_RESOURCE_BUCKET }}
+          GMAIL=${{ secrets.GMAIL }}
+          GMAIL_PASSWORD=${{ secrets.GMAIL_PASSWORD }}
+          DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}
+          DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}
+          EOF
+          chmod +x deploy.dev.sh
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Create Deployment Package
run: |
echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" > .env
echo "DB_HOST=${{ secrets.DB_HOST }}" >> .env
echo "DB_PORT=${{ secrets.DB_PORT }}" >> .env
echo "DB_NAME_DEV=${{ secrets.DB_NAME_DEV }}" >> .env
echo "DB_USERNAME=${{ secrets.DB_USERNAME }}" >> .env
echo "DB_PASSWORD=${{ secrets.DB_PASSWORD }}" >> .env
echo "GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}" >> .env
echo "GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}" >> .env
echo "GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }}" >> .env
echo "GOOGLE_ISSUER=${{secrets.GOOGLE_ISSUER}}" >> .env
echo "SELF_ISSUER=${{secrets.SELF_ISSUER}}" >> .env
echo "SECRET_KEY=${{secrets.SECRET_KEY}}" >> .env
echo "AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }}" >> .env
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}" >> .env
echo "AWS_REGION=${{ secrets.AWS_REGION }}" >> .env
echo "AWS_RESOURCE_BUCKET=${{secrets.AWS_RESOURCE_BUCKET}}" >> .env
echo "AWS_TEST_RESOURCE_BUCKET=${{secrets.AWS_TEST_RESOURCE_BUCKET}}" >> .env
echo "GMAIL=${{secrets.GMAIL}}" >> .env
echo "GMAIL_PASSWORD=${{secrets.GMAIL_PASSWORD}}" >> .env
echo "DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}" >> .env
echo "DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}" >> .env
- name: Create Deployment Package
run: |
cat > .env <<'EOF'
DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}
DB_HOST=${{ secrets.DB_HOST }}
DB_PORT=${{ secrets.DB_PORT }}
DB_NAME_DEV=${{ secrets.DB_NAME_DEV }}
DB_USERNAME=${{ secrets.DB_USERNAME }}
DB_PASSWORD=${{ secrets.DB_PASSWORD }}
GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}
GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }}
GOOGLE_ISSUER=${{ secrets.GOOGLE_ISSUER }}
SELF_ISSUER=${{ secrets.SELF_ISSUER }}
SECRET_KEY=${{ secrets.SECRET_KEY }}
# AWS credentials are intentionally omitted; use role/OIDC at runtime
AWS_REGION=${{ secrets.AWS_REGION }}
AWS_RESOURCE_BUCKET=${{ secrets.AWS_RESOURCE_BUCKET }}
AWS_TEST_RESOURCE_BUCKET=${{ secrets.AWS_TEST_RESOURCE_BUCKET }}
GMAIL=${{ secrets.GMAIL }}
GMAIL_PASSWORD=${{ secrets.GMAIL_PASSWORD }}
DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}
DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}
EOF
chmod +x deploy.dev.sh
🧰 Tools
🪛 actionlint (1.7.7)

34-34: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

(shellcheck)

🪛 YAMLlint (1.37.1)

[error] 36-36: trailing spaces

(trailing-spaces)

🤖 Prompt for AI Agents 
.github/workflows/deploy-dev.yml around lines 33 to 55: the current step appends
many secrets with repeated echo/>> which triggers ShellCheck SC2129 and can
break on spaces/special chars; replace the repeated echo lines with a single
here-document to atomically write the .env file (ensuring values are not subject
to word-splitting or globbing), quote variable expansions where appropriate, and
set the deploy script executable (chmod +x) before packaging so it runs
correctly during deployment.

zip -r deploy.zip .env docker-compose-dev.yml deploy.dev.sh appspec.yml
- name: Configure AWS credentials
run: |
aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }}
aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws configure set region ${{ secrets.AWS_REGION }}
- name: Upload Deployment Package to S3
run: |
aws s3 cp deploy.zip s3://${{ secrets.AWS_S3_BUCKET }}/deploy-dev.zip
- name: Deploy to AWS CodeDeploy
run: |
aws deploy create-deployment \
--application-name ${{ secrets.AWS_CODEDEPLOY_APP }} \
--deployment-group-name ${{ secrets.AWS_CODEDEPLOY_GROUP_DEV }} \
--s3-location bucket=${{ secrets.AWS_S3_BUCKET }},bundleType=zip,key=deploy-dev.zip
16 changes: 9 additions & 7 deletions .github/workflows/deploy.yml → .github/workflows/deploy-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Deploy to EC2 via Docker Hub and CodeDeploy
name: CD - PROD
Copy link

@coderabbitai coderabbitai bot Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

OIDC 사용을 위한 permissions 선언.

프로덕션 워크플로우 루트에 다음 권한이 필요합니다.

permissions:
  id-token: write
  contents: read
🤖 Prompt for AI Agents 
.github/workflows/deploy-prod.yml around lines 1 to 1: the workflow is missing
the required top-level permissions for OIDC; add a top-level permissions mapping
with "id-token: write" and "contents: read" (properly indented as top-level keys
in the YAML, placed directly under the workflow name and before jobs) to enable
OIDC token issuance for the production deployment workflow and ensure valid YAML
syntax.


on:
push:
Expand All @@ -11,10 +11,10 @@ jobs:

steps:
- name: Checkout Repository
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Log in to Docker Hub
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
Expand All @@ -26,9 +26,9 @@ jobs:

- name: move files to Root
run: |
cp gdgoc/docker-compose.yml ./docker-compose.yml
cp gdgoc/deploy.sh ./deploy.sh
cp gdgoc/appspec.yml ./appspec.yml
cp gdgoc/docker-compose-prod.yml ./docker-compose-prod.yml
cp gdgoc/deploy.prod.sh ./deploy.prod.sh
cp gdgoc/appspec.prod.yml ./appspec.yml

- name: Create Deployment Package
run: |
Expand All @@ -51,8 +51,10 @@ jobs:
echo "AWS_TEST_RESOURCE_BUCKET=${{secrets.AWS_TEST_RESOURCE_BUCKET}}" >> .env
echo "GMAIL=${{secrets.GMAIL}}" >> .env
echo "GMAIL_PASSWORD=${{secrets.GMAIL_PASSWORD}}" >> .env
echo "DOZZLE_USERNAME=${{ secrets.DOZZLE_USERNAME }}" >> .env
echo "DOZZLE_PASSWORD=${{ secrets.DOZZLE_PASSWORD }}" >> .env

zip -r deploy.zip .env docker-compose.yml deploy.sh appspec.yml
zip -r deploy.zip .env docker-compose-prod.yml deploy.prod.sh appspec.yml

- name: Configure AWS credentials
run: |
Expand Down
11 changes: 11 additions & 0 deletions gdgoc/appspec.dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
version: 0.0
os: linux
files:
- source: /
destination: /home/ubuntu/gdgoc-be-app-dev

hooks:
AfterInstall:
- location: deploy.dev.sh
timeout: 300
runas: root
2 changes: 1 addition & 1 deletion gdgoc/appspec.yml → gdgoc/appspec.prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,6 @@ files:

hooks:
AfterInstall:
- location: deploy.sh
- location: deploy.prod.sh
timeout: 300
runas: root
38 changes: 38 additions & 0 deletions gdgoc/deploy.dev.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
#!/bin/bash
# shellcheck disable=SC2164
cd /home/ubuntu/gdgoc-be-app-dev

# Docker & Docker Compose가 설치되어 있는지 확인
if ! [ -x "$(command -v docker)" ]; then
echo "Docker가 설치되어 있지 않습니다. 설치 중..."
sudo apt update
sudo apt install -y docker.io
sudo systemctl start docker
sudo systemctl enable docker
echo "Docker 설치 완료"
fi

if ! [ -x "$(command -v docker-compose)" ]; then
echo "Docker Compose가 설치되어 있지 않습니다. 설치 중..."
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
echo "Docker Compose 설치 완료"
fi

# 기존 컨테이너 중지 및 삭제
docker-compose -f docker-compose-dev.yml down

# 사용되지 않는 컨테이너, 이미지, 네트워크, 볼륨 정리
docker system prune -af

# 불필요한 Docker 볼륨도 정리 (옵션)
docker volume prune -f

# 최신 이미지 가져오기
# shellcheck disable=SC2046
export $(grep -v '^#' .env | xargs)
# shellcheck disable=SC2086
docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app-dev:latest

# 컨테이너 실행
docker-compose -f docker-compose-dev.yml --env-file .env up -d
7 changes: 5 additions & 2 deletions gdgoc/deploy.sh → gdgoc/deploy.prod.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/bin/bash
# shellcheck disable=SC2164
cd /home/ubuntu/gdgoc-be-app

# Docker & Docker Compose가 설치되어 있는지 확인
Expand All @@ -19,7 +20,7 @@ if ! [ -x "$(command -v docker-compose)" ]; then
fi

# 기존 컨테이너 중지 및 삭제
docker-compose down
docker-compose -f docker-compose-prod.yml down

# 사용되지 않는 컨테이너, 이미지, 네트워크, 볼륨 정리
docker system prune -af
Expand All @@ -28,8 +29,10 @@ docker system prune -af
docker volume prune -f

# 최신 이미지 가져오기
# shellcheck disable=SC2046
export $(grep -v '^#' .env | xargs)
# shellcheck disable=SC2086
docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app:latest
Comment on lines 31 to 35
Copy link

@coderabbitai coderabbitai bot Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

.env 로드 방식 취약: 공백/특수문자/주석에 취약

export $(grep ... | xargs)는 값에 공백/#/=가 포함되면 깨집니다. ShellCheck 경고를 억제하기보다 안전한 로딩으로 바꾸세요.

아래와 같이 변경 제안:

-# shellcheck disable=SC2046
-export $(grep -v '^#' .env | xargs)
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# 최신 이미지 가져오기
# shellcheck disable=SC2046
export $(grep -v '^#' .env | xargs)
# shellcheck disable=SC2086
docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app:latest
# 최신 이미지 가져오기
set -a
# shellcheck disable=SC1091
source .env
set +a
# shellcheck disable=SC2086
docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app:latest
🤖 Prompt for AI Agents 
In gdgoc/deploy.prod.sh around lines 31 to 35, the current use of "export $(grep
-v '^#' .env | xargs)" is unsafe for .env entries containing spaces, hashes or
equals signs; replace it with a safe line-by-line parser: read the .env file
ignoring empty lines and comments, for each line split on the first = using
IFS='=' and read -r key value, trim surrounding quotes from the value, then
export the variable with its exact value (e.g., export "$key=$value"); ensure
you handle values containing spaces, #, or = correctly and avoid shellcheck
disables.

Copy link

@coderabbitai coderabbitai bot Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

이미지 latest 사용: 재현 불가/예기치 않은 롤백

운영에서 :latest는 비재현성·롤백 혼선을 유발합니다. Git SHA 또는 릴리스 버전 태그로 고정하세요. CI에서 IMAGE_TAG를 주입받도록 권장합니다.

예시:

-docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app:latest
+IMAGE_TAG="${IMAGE_TAG:?IMAGE_TAG is required}"
+docker pull "${DOCKER_HUB_USERNAME}/gdgoc-be-app:${IMAGE_TAG}"

그리고 compose 파일에서도 동일 태그를 사용하도록 .env 또는 compose override를 정렬해 주세요.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
docker pull ${DOCKER_HUB_USERNAME}/gdgoc-be-app:latest
IMAGE_TAG="${IMAGE_TAG:?IMAGE_TAG is required}"
docker pull "${DOCKER_HUB_USERNAME}/gdgoc-be-app:${IMAGE_TAG}"
🤖 Prompt for AI Agents 
In gdgoc/deploy.prod.sh around line 35, the script currently pulls the image
using the non-deterministic tag "latest", which can cause unreproducible
deployments and rollback confusion; change the script to use a specific tag
supplied by CI (e.g., use ${IMAGE_TAG} or ${GIT_SHA}) instead of :latest,
validate IMAGE_TAG is set and fail fast if missing, and update your Docker
Compose usage by aligning .env or the compose override to reference the same
IMAGE_TAG so both deploy script and compose use the identical immutable tag.


# 컨테이너 실행
docker-compose --env-file .env up -d
docker-compose -f docker-compose-prod.yml --env-file .env up -d
32 changes: 32 additions & 0 deletions gdgoc/docker-compose-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
version: "3.8"

services:
app:
image: "${DOCKER_HUB_USERNAME}/gdgoc-be-app-dev:latest"
container_name: gdgoc-be-app-dev
restart: always
ports:
- "8080:8080"
environment:
SPRING_PROFILES_ACTIVE: dev
SPRING_DATASOURCE_URL: "jdbc:postgresql://${DB_HOST}:${DB_PORT}/${DB_NAME_DEV}"
SPRING_DATASOURCE_USERNAME: "${DB_USERNAME}"
SPRING_DATASOURCE_PASSWORD: "${DB_PASSWORD}"
volumes:
- /home/ubuntu/gdgoc-be-app-dev/.env:/app/.env
env_file:
- .env

dozzle:
container_name: dozzle
image: amir20/dozzle:v5.4.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
ports:
- 9999:8080
environment:
DOZZLE_USERNAME: "${DOZZLE_USERNAME}"
DOZZLE_PASSWORD: "${DOZZLE_PASSWORD}"
restart: always
env_file:
- .env
14 changes: 14 additions & 0 deletions gdgoc/docker-compose.yml → gdgoc/docker-compose-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,17 @@ services:
- /home/ubuntu/gdgoc-be-app/.env:/app/.env
env_file:
- .env

dozzle:
container_name: dozzle
image: amir20/dozzle:v5.4.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
ports:
- 9999:8080
environment:
DOZZLE_USERNAME: "${DOZZLE_USERNAME}"
DOZZLE_PASSWORD: "${DOZZLE_PASSWORD}"
restart: always
env_file:
- .env
68 changes: 68 additions & 0 deletions gdgoc/src/main/resources/application-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
server:
forward-headers-strategy: framework

spring:
jackson:
time-zone: Asia/Seoul
datasource:
url: ${SPRING_DATASOURCE_URL}
username: ${SPRING_DATASOURCE_USERNAME}
password: ${SPRING_DATASOURCE_PASSWORD}
driver-class-name: org.postgresql.Driver
servlet:
multipart:
max-file-size: 10MB
max-request-size: 12MB
jpa:
database: postgresql
hibernate:
ddl-auto: none
properties:
hibernate:
default_batch_fetch_size: 100
time_zone: Asia/Seoul
show-sql: false
database-platform: org.hibernate.dialect.PostgreSQLDialect
flyway:
enabled: true
baseline-on-migrate: false
clean-disabled: true
validate-migration-naming: true
locations: classpath:db/migration
mail:
host: smtp.gmail.com
port: 587
username: ${GMAIL}
password: ${GMAIL_PASSWORD}
properties:
mail:
smtp:
auth: true
starttls:
enable: true

logging:
level:
org.hibernate.SQL: debug
org.hibernate.type: off


google:
client-id: ${GOOGLE_CLIENT_ID}
client-secret: ${GOOGLE_CLIENT_SECRET}
redirect-uri: ${GOOGLE_REDIRECT_URI}

jwt:
googleIssuer: ${GOOGLE_ISSUER}
selfIssuer: ${SELF_ISSUER}
secretKey: ${SECRET_KEY}

cloud:
aws:
credentials:
access-key: ${AWS_ACCESS_KEY_ID}
secret-key: ${AWS_SECRET_ACCESS_KEY}
region:
static: ${AWS_REGION}
s3:
bucket: ${WS_TEST_RESOURCE_BUCKET}
2 changes: 1 addition & 1 deletion gdgoc/src/main/resources/application-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ spring:
database-platform: org.hibernate.dialect.PostgreSQLDialect
flyway:
enabled: true
baseline-on-migrate: true # 변경 확인 후 제거 예정
baseline-on-migrate: false
clean-disabled: true
validate-migration-naming: true
locations: classpath:db/migration
Expand Down
Loading