[refactor/#351] 배포 Github Action과 Docker 리펙토링

.dockerignore

@@ -0,0 +1,20 @@
+# 기본적으로 무시할 것들
+.git
+.idea
+.vscode
+*.log
+*.iml
+
+# 빌드 결과물 무시
+build/
+target/
+
+# 민감 파일 무시
+src/main/resources/application-secret.yml
+
+#도커 관련 파일
+docker-compose.yml
+Dockerfile
+
+# 깃허브 파일
+.github/

.github/workflows/dev_deploy.yml

@@ -3,12 +3,18 @@ name: CI/CD Pipeline
 on:
   push:
     branches: [ develop ]
+  pull_request:
+    branches: [ develop ]
 
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      GRADLE_BUILD_CACHE_URL: ${{ secrets.GRADLE_BUILD_CACHE_URL }}
+      GRADLE_BUILD_CACHE_USERNAME: ${{ secrets.GRADLE_BUILD_CACHE_USERNAME }}
+      GRADLE_BUILD_CACHE_PASSWORD: ${{ secrets.GRADLE_BUILD_CACHE_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
@@ -22,36 +28,118 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x ./gradlew
 
-      - name: make application-secret.yml
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          install: true
+
+      - name: Create and use buildx builder
         run: |
-          touch ./src/main/resources/application-secret.yml
-          echo "${{ secrets.APPLICATION_SECRET }}" > ./src/main/resources/application-secret.yml
-        shell: bash
+          docker buildx create --use --name mybuilder
+          docker buildx inspect --bootstrap
+
+      - name: Log in to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Check Dockerfile or Dependency Changes
+        id: check_changes
+        run: |
+          git fetch origin ${{ github.event.before }}
+          echo "Changed files between commits:"
+          changed_files=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }})
+          echo "$changed_files"
+
+          if echo "$changed_files" | grep -qE 'Dockerfile|build\.gradle|settings\.gradle|gradle\.properties|gradlew|gradle/wrapper/gradle-wrapper\.properties'; then
+            echo "changed=true" >> $GITHUB_ENV
+          else
+            echo "changed=false" >> $GITHUB_ENV
+          fi
+
+      - name: Build & Push Dependency Cache
+        if: env.changed == 'true'
+        run: |
+          docker buildx build \
+            --builder mybuilder \
+            --platform linux/amd64 \
+            --push \
+            --file Dockerfile \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:dependency-cache \
+            --cache-to type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:dependency-cache,mode=max \
+            --secret type=env,id=GRADLE_BUILD_CACHE_URL,env=GRADLE_BUILD_CACHE_URL \
+            --secret type=env,id=GRADLE_BUILD_CACHE_USERNAME,env=GRADLE_BUILD_CACHE_USERNAME \
+            --secret type=env,id=GRADLE_BUILD_CACHE_PASSWORD,env=GRADLE_BUILD_CACHE_PASSWORD \
+            .
+
+      - name: Build & Push Application Image
+        run: |
+          docker buildx build \
+            --builder mybuilder \
+            --platform linux/amd64 \
+            --push \
+            --file Dockerfile \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:1.0.0 \
+            --build-arg DEPENDENCY_IMAGE=${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:dependency-cache \
+            --cache-from type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:dependency-cache \
+            --secret type=env,id=GRADLE_BUILD_CACHE_URL,env=GRADLE_BUILD_CACHE_URL \
+            --secret type=env,id=GRADLE_BUILD_CACHE_USERNAME,env=GRADLE_BUILD_CACHE_USERNAME \
+            --secret type=env,id=GRADLE_BUILD_CACHE_PASSWORD,env=GRADLE_BUILD_CACHE_PASSWORD \
+            .
 
-      - name: Build with Gradle Wrapper
+      - name: Create application-secret.yml from Secret
         run: |
-          ./gradlew --stop && ./gradlew clean --refresh-dependencies
-          ./gradlew clean build
-          ls -l build/libs 
+          mkdir -p ./temp_secret
+          echo "${{ secrets.APPLICATION_SECRET }}" > ./temp_secret/application-secret.yml
+        shell: bash
 
+      - name: Copy application-secret.yml to remote
+        uses: appleboy/[email protected]
+        with:
+          username: ubuntu
+          host: ${{ secrets.EC2_HOST }}
+          key: ${{ secrets.EC2_SSH_KEY }}
+          source: ./temp_secret/application-secret.yml
+          target: /home/ubuntu/secret/
 
-      - name: Build Docker Image
+      - name: Check if docker-compose.yml changed
+        id: docker_compose_changed
         run: |
-          docker build -t yongjun0511/clokey-docker:1.0.0 .
+          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q "docker-compose.yml"; then
+            echo "changed=true" >> $GITHUB_ENV
+          else
+            echo "changed=false" >> $GITHUB_ENV
+          fi
 
-      - name: Push Docker Image
+      - name: Copy docker-compose.yml to remote
+        if: env.changed == 'true'
+        uses: appleboy/[email protected]
+        with:
+          username: ubuntu
+          host: ${{ secrets.EC2_HOST }}
+          key: ${{ secrets.EC2_SSH_KEY }}
+          source: ./docker-compose.yml
+          target: /home/ubuntu/cicd/
+
+      - name: Check if deploy.sh changed
+        id: deploy_sh_changed
         run: |
-          echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
-          docker push yongjun0511/clokey-docker:1.0.0 
+          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q "deploy.sh"; then
+            echo "deploy_changed=true" >> $GITHUB_ENV
+          else
+            echo "deploy_changed=false" >> $GITHUB_ENV
+          fi
 
-      - name: Copy docker-compose file to remote
+      - name: Copy deploy.sh to remote
+        if: env.deploy_changed == 'true'
         uses: appleboy/[email protected]
         with:
           username: ubuntu
           host: ${{ secrets.EC2_HOST }}
           key: ${{ secrets.EC2_SSH_KEY }}
-          source: "./docker-compose.yml"
-          target: "/home/ubuntu/cicd/"
+          source: ./deploy.sh
+          target: /home/ubuntu/cicd/
 
       - name: Deploy Blue-Green
         uses: appleboy/ssh-action@master
@@ -61,8 +149,6 @@ jobs:
           key: ${{ secrets.EC2_SSH_KEY }}
           script: |
             echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
-            docker pull yongjun0511/clokey-docker:1.0.0 
+            docker pull ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker:1.0.0
             sudo chmod +x /home/ubuntu/cicd/deploy.sh
             sudo /home/ubuntu/cicd/deploy.sh
-
-

Dockerfile

@@ -1,17 +1,41 @@
+# syntax=docker/dockerfile:1.4
+
+FROM gradle:8.5-jdk17 AS dependencies
+WORKDIR /build
+
+COPY gradlew .
+COPY gradle.properties /root/.gradle/gradle.properties
+COPY gradle/wrapper/gradle-wrapper.jar gradle/wrapper/
+COPY gradle/wrapper/gradle-wrapper.properties gradle/wrapper/
+COPY build.gradle settings.gradle ./
+
+RUN ./gradlew dependencies --no-daemon
+
+FROM gradle:8.5-jdk17 AS builder
+WORKDIR /build
+
+COPY --from=dependencies /build /build
+COPY src src
+
+RUN --mount=type=secret,id=GRADLE_BUILD_CACHE_URL \
+    --mount=type=secret,id=GRADLE_BUILD_CACHE_USERNAME \
+    --mount=type=secret,id=GRADLE_BUILD_CACHE_PASSWORD \
+    bash -euxo pipefail -c " \
+      echo '==== Mounted Secrets ====' && \
+      ls -l /run/secrets && \
+      export GRADLE_BUILD_CACHE_URL=\$(cat /run/secrets/GRADLE_BUILD_CACHE_URL | tr -d '\r\n') && \
+      export GRADLE_BUILD_CACHE_USERNAME=\$(cat /run/secrets/GRADLE_BUILD_CACHE_USERNAME | tr -d '\r\n') && \
+      export GRADLE_BUILD_CACHE_PASSWORD=\$(cat /run/secrets/GRADLE_BUILD_CACHE_PASSWORD | tr -d '\r\n') && \
+      ./gradlew bootJar -x test --build-cache \
+    "
+
 FROM openjdk:17-jdk-slim
 
-# Set the timezone to Asia/Seoul
 ENV TZ=Asia/Seoul
-RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ >/etc/timezone
 
-# Set the working directory
 WORKDIR /app
 
-# Copy the built JAR file into the container
-COPY ./build/libs/*.jar app.jar
-
-# Expose the port your application will run on
-EXPOSE 8080
+COPY --from=builder /build/build/libs/*.jar app.jar
 
-# Command to run the JAR file
 ENTRYPOINT ["java", "-jar", "/app/app.jar"]

deploy.sh

@@ -0,0 +1,119 @@
+#!/bin/bash
+
+cd /home/ubuntu/cicd
+
+APP_NAME="clokey"
+
+# NGINX 설정 관련
+NGINX_CONF_PATH="/etc/nginx"
+BLUE_CONF="blue.conf"
+GREEN_CONF="green.conf"
+DEFAULT_CONF="nginx.conf"
+MAX_RETRIES=3
+
+# 활성화된 서비스 확인 및 스위칭 대상 결정
+determine_target() {
+  if docker-compose -f docker-compose.yml ps | grep -q "app_blue.*Up"; then
+    TARGET="green"
+    OLD="blue"
+  elif docker-compose -f docker-compose.yml ps | grep -q "app_green.*Up"; then
+    TARGET="blue"
+    OLD="green"
+  else
+    TARGET="blue"  # 첫 실행 시 기본값
+    OLD="none"
+  fi
+
+  echo "TARGET: $TARGET"
+  echo "OLD: $OLD"
+}
+
+# 헬스체크 실패 시 롤백 처리
+health_check() {
+  local URL=$1
+  local RETRIES=0
+  local ORIGINAL_TARGET=$TARGET  # 원래 TARGET 값을 저장
+
+  while [ $RETRIES -lt $MAX_RETRIES ]; do
+    echo "Checking service at $URL... (attempt: $((RETRIES + 1)))"
+    sleep 3
+
+    # 현재 실행 중인 컨테이너 확인
+    CONTAINER_RUNNING=$(docker ps --filter "name=app_$TARGET" --format '{{.Names}}')
+
+    if [ "$CONTAINER_RUNNING" = "app_$TARGET" ]; then
+      echo "$TARGET container is running."
+      return 0  # 컨테이너가 실행 중이라면 헬스체크 성공
+    else
+      echo "$TARGET container is not running."
+    fi
+
+    RETRIES=$((RETRIES + 1))
+  done
+
+  # 헬스체크 실패 시 롤백 처리
+  echo "Health check failed after $MAX_RETRIES attempts."
+  echo "Rolling back to the original target: $ORIGINAL_TARGET"
+
+  # TARGET을 원래 값으로 롤백
+  TARGET=$ORIGINAL_TARGET
+  echo "Rolled back TARGET: $TARGET"
+
+  # 로그 파일에 실패 기록
+  echo "Failed health check for $TARGET container" > /home/ubuntu/cicd/health_check_failure.log
+
+  # docker-compose down 대신 실패 기록 후 종료
+  exit 1
+}
+
+# NGINX 설정 스위칭 함수
+switch_nginx_conf() {
+  if [ "$TARGET" = "blue" ]; then
+    sudo cp "${NGINX_CONF_PATH}/${BLUE_CONF}" "${NGINX_CONF_PATH}/${DEFAULT_CONF}"
+  else
+    sudo cp "${NGINX_CONF_PATH}/${GREEN_CONF}" "${NGINX_CONF_PATH}/${DEFAULT_CONF}"
+  fi
+
+  echo "Reloading NGINX configuration..."
+  nginx -s reload
+}
+
+# 이전 컨테이너 종료 함수
+down_old_container() {
+  if [ "$OLD" != "none" ]; then
+    echo "Stopping old container: $OLD"
+    sudo docker stop "app_$OLD"
+
+  fi
+}
+
+# 메인 실행 로직
+main() {
+  determine_target
+
+
+  # 대상 컨테이너 실행
+  echo "Starting $TARGET container..."
+  docker-compose -f docker-compose.yml up -d "app_$TARGET"
+
+  # 헬스체크
+  if [ "$TARGET" = "blue" ]; then
+    health_check "http://127.0.0.1:8080/actuator/health"
+  else
+    health_check "http://127.0.0.1:8081/actuator/health"
+  fi
+
+  # NGINX 설정 스위칭
+  switch_nginx_conf
+
+  # 이전 컨테이너 종료
+  down_old_container
+
+  echo "Deployment to $TARGET completed successfully!"
+
+  echo "Cleaning up dangling Docker images..."
+  docker image prune -f
+}
+
+# 스크립트 실행
+main

docker-compose.yml

@@ -1,4 +1,4 @@
-version: '3.8'
+name: clokey_project
 
 services:
   app_blue:
@@ -7,7 +7,10 @@ services:
     ports:
       - "8080:8080"
     environment:
-      - SPRING_PROFILES_ACTIVE=blue  # 애플리케이션에서 'blue' 프로필로 설정
+      - SPRING_PROFILES_ACTIVE=blue
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=file:/app/config/
+    volumes:
+      - /home/ubuntu/secret/application-secret.yml:/app/config/application-secret.yml:ro
     networks:
       - app_network
 
@@ -17,7 +20,10 @@ services:
     ports:
       - "8081:8080"
     environment:
-      - SPRING_PROFILES_ACTIVE=green  # 애플리케이션에서 'green' 프로필로 설정
+      - SPRING_PROFILES_ACTIVE=green
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=file:/app/config/
+    volumes:
+      - /home/ubuntu/secret/application-secret.yml:/app/config/application-secret.yml:ro
     networks:
       - app_network
 

gradle.properties

@@ -0,0 +1,3 @@
+org.gradle.caching=true             # ?? + ?? ?? ???
+org.gradle.configureondemand=true
+org.gradle.terms.of.use=true