[RELEASE] dev to main

.env.example

@@ -0,0 +1,42 @@
+# Spring Profile
+SPRING_PROFILES_ACTIVE=local
+
+# Database
+DB_URL=jdbc:mysql://localhost:3306/your_db_name?allowPublicKeyRetrieval=true&useSSL=false&characterEncoding=UTF-8
+DB_NAME=your_db_name
+DB_USERNAME=your_username
+DB_PASSWORD=your_password
+DB_ROOT_PASSWORD=your_root_password
+
+# Redis
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=your_redis_password
+
+# S3
+S3_ENDPOINT=http://localhost:9000
+S3_REGION=ap-northeast-2
+S3_ACCESS_KEY=your_access_key
+S3_SECRET_KEY=your_secret_key
+S3_PUBLIC_BUCKET=your_public_bucket_name
+S3_PRIVATE_BUCKET=your_private_bucket_name
+
+# JWT
+JWT_SECRET_KEY=your_jwt_secret_key_here_base64url_encoded
+JWT_ACCESS_TOKEN_EXPIRATION=3600000
+JWT_REFRESH_TOKEN_EXPIRATION=1209600000
+JWT_COOKIE_SECURE=false
+JWT_REFRESH_COOKIE_PATH=/api/v1/auth
+
+# Mail
+MAIL_HOST=smtp.gmail.com
+MAIL_PORT=587
+MAIL_USERNAME=your_email@gmail.com
+MAIL_PASSWORD=your_app_password
+
+# Encryption
+ENCRYPT_SECRET_KEY=your_encrypt_secret_key
+ENCRYPT_HASH_KEY=your_encrypt_hash_key
+
+# Admin
+ADMIN_NOTIFICATION_EMAIL=admin@example.com

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,12 +1,12 @@
-## **🚀 Related issue**
+## **🚀 Related issue**
 
 Closes #이슈번호
 
 ## **#️⃣ Summary**
 
 - PR 한줄 요약
 
-## **🔧 Changes*
+## **🔧 Changes**
 
 - [ ] 작업 내용
 - [ ] 작업 내용
@@ -15,6 +15,6 @@ Closes #이슈번호
 
 - swagger나 postman 결과를 캡쳐하여 첨부
 
-## **💬 Reviewer Notes**
+## **💬 Reviewer Notes**
 
 - 리뷰어나 같이 작업하는 사람들에게 남길 코멘트

.github/workflows/ci.yml

@@ -3,6 +3,8 @@ name: CI
 on:
   pull_request:
     branches: [ main, dev ]
+  push:
+    branches: [ main ]
 
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
@@ -14,16 +16,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654   # v5.2.0
         with:
           java-version: '21'
           distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c    # v5.0.2
 
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew

.github/workflows/deploy.yml

@@ -0,0 +1,138 @@
+name: deploy
+
+on:
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+    branches:
+      - main
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  AWS_REGION: ap-northeast-2
+  ECR_REPOSITORY: ditda-api
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+jobs:
+  build-and-deploy:
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push'
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654   # v5.2.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+          cache: "gradle"
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5    # v6.1.2
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ditda-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419   # v2.1.5
+
+      - name: Grant gradlew permission
+        run: chmod +x gradlew
+
+      - name: Build & push image with Jib
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
+        run: |
+          ./gradlew jib \
+            -Djib.to.image=${ECR_REGISTRY} \
+            -Djib.to.tags=latest,${{ github.event.workflow_run.head_sha }}
+
+      - name: Deploy to EC2 via SSM
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
+          IMAGE_TAG: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          COMMAND_ID=$(aws ssm send-command \
+            --instance-ids "${{ secrets.EC2_INSTANCE_ID }}" \
+            --document-name "AWS-RunShellScript" \
+            --parameters "commands=[
+              'curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/${{ github.event.workflow_run.head_sha }}/scripts/deploy.sh -o /tmp/deploy.sh',
+              'chmod +x /tmp/deploy.sh',
+              'export AWS_REGION=${{ env.AWS_REGION }}',
+              'export ECR_REGISTRY=${ECR_REGISTRY}',
+              'export IMAGE_TAG=${IMAGE_TAG}',
+              'export GITHUB_REPO=${{ github.repository }}',
+              'export COMMIT_SHA=${{ github.event.workflow_run.head_sha }}',
+              'bash /tmp/deploy.sh'
+            ]" \
+            --timeout-seconds 600 \
+            --query "Command.CommandId" \
+            --output text)
+
+          echo "Command ID: ${COMMAND_ID}"
+
+          for i in {1..120}; do
+            STATUS=$(aws ssm get-command-invocation \
+              --command-id "${COMMAND_ID}" \
+              --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
+              --query "Status" --output text 2>/dev/null || echo "Pending")
+            echo "Status: ${STATUS}"
+
+            if [ "${STATUS}" = "Success" ]; then
+              aws ssm get-command-invocation \
+                --command-id "${COMMAND_ID}" \
+                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
+                --query "StandardOutputContent" --output text
+              exit 0
+            elif [ "${STATUS}" = "Failed" ] || [ "${STATUS}" = "Cancelled" ] || [ "${STATUS}" = "TimedOut" ]; then
+              echo "=== STDOUT ==="
+              aws ssm get-command-invocation \
+                --command-id "${COMMAND_ID}" \
+                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
+                --query "StandardOutputContent" --output text
+              echo "=== STDERR ==="
+              aws ssm get-command-invocation \
+                --command-id "${COMMAND_ID}" \
+                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
+                --query "StandardErrorContent" --output text
+              exit 1
+            fi
+            sleep 5
+          done
+
+          echo "❌ 타임아웃"
+          exit 1
+
+      - name: Send Discord notification on success
+        if: success()
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json" \
+            -d "{\"embeds\": [{\"title\": \"🚀 DITDA 배포 성공\", \"description\": \"https://api.ditda.kr\", \"color\": 3066993, \"fields\": [{\"name\": \"Branch\", \"value\": \"${{ github.ref_name }}\", \"inline\": true}, {\"name\": \"Commit\", \"value\": \"\`${GITHUB_SHA:0:7}\`\", \"inline\": true}, {\"name\": \"Author\", \"value\": \"${{ github.actor }}\", \"inline\": true}], \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%S.000Z)\"}]}" \
+            $DISCORD_WEBHOOK || true
+
+      - name: Send Discord notification on failure
+        if: failure()
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json" \
+            -d "{\"embeds\": [{\"title\": \"❌ DITDA 배포 실패\", \"description\": \"GitHub Actions 로그 확인 필요\", \"color\": 15158332, \"fields\": [{\"name\": \"Branch\", \"value\": \"${{ github.ref_name }}\", \"inline\": true}, {\"name\": \"Commit\", \"value\": \"\`${GITHUB_SHA:0:7}\`\", \"inline\": true}, {\"name\": \"Author\", \"value\": \"${{ github.actor }}\", \"inline\": true}, {\"name\": \"Run\", \"value\": \"[로그 보기](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})\", \"inline\": false}], \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%S.000Z)\"}]}" \
+            $DISCORD_WEBHOOK || true

.gitignore

@@ -35,3 +35,13 @@ out/
 
 ### VS Code ###
 .vscode/
+
+### Spring Boot ###
+*.pid
+*.log.*
+logs/
+
+### Environment ###
+.env
+.env.*
+!.env.example

build.gradle

@@ -1,39 +1,108 @@
 plugins {
-	id 'java'
-	id 'org.springframework.boot' version '4.0.6'
-	id 'io.spring.dependency-management' version '1.1.7'
+    id 'java'
+    id 'org.springframework.boot' version '4.0.6'
+    id 'io.spring.dependency-management' version '1.1.7'
+    id 'com.google.cloud.tools.jib' version '3.5.3'
+    id 'checkstyle'
 }
 
 group = 'ditda'
 version = '0.0.1-SNAPSHOT'
 
 java {
-	toolchain {
-		languageVersion = JavaLanguageVersion.of(21)
-	}
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(21)
+    }
 }
 
 repositories {
-	mavenCentral()
+    mavenCentral()
 }
 
 dependencies {
-	implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
-	implementation 'org.springframework.boot:spring-boot-starter-security'
-	implementation 'org.springframework.boot:spring-boot-starter-validation'
-	implementation 'org.springframework.boot:spring-boot-starter-webmvc'
-	compileOnly 'org.projectlombok:lombok'
-	runtimeOnly 'com.mysql:mysql-connector-j'
-	annotationProcessor 'org.projectlombok:lombok'
-	testImplementation 'org.springframework.boot:spring-boot-starter-data-jpa-test'
-	testImplementation 'org.springframework.boot:spring-boot-starter-security-test'
-	testImplementation 'org.springframework.boot:spring-boot-starter-validation-test'
-	testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
-	testCompileOnly 'org.projectlombok:lombok'
-	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-	testAnnotationProcessor 'org.projectlombok:lombok'
+    // web
+    implementation 'org.springframework.boot:spring-boot-starter-web'
+
+    // security
+    implementation 'org.springframework.boot:spring-boot-starter-security'
+
+    // mysql
+    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
+    runtimeOnly 'com.mysql:mysql-connector-j'
+
+    // S3
+    implementation platform('io.awspring.cloud:spring-cloud-aws-dependencies:4.0.2')
+    implementation 'io.awspring.cloud:spring-cloud-aws-starter-s3'
+
+    // redis
+    implementation 'org.springframework.boot:spring-boot-starter-data-redis'
+
+    // jwt
+    implementation 'io.jsonwebtoken:jjwt-api:0.13.0'
+    runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.13.0'
+    runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.13.0'
+
+    // email
+    implementation 'org.springframework.boot:spring-boot-starter-mail'
+
+    // thymeleaf
+    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
+
+    // swagger
+    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3'
+
+    // devtools
+    developmentOnly 'org.springframework.boot:spring-boot-devtools'
+
+    // lombok
+    compileOnly 'org.projectlombok:lombok'
+    annotationProcessor 'org.projectlombok:lombok'
+    testCompileOnly 'org.projectlombok:lombok'
+    testAnnotationProcessor 'org.projectlombok:lombok'
+
+    // actuator
+    implementation 'org.springframework.boot:spring-boot-starter-actuator'
+
+    // test
+    testImplementation 'org.springframework.boot:spring-boot-starter-test'
+    testImplementation 'org.springframework.security:spring-security-test'
+    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+    testImplementation 'com.h2database:h2'
+}
+
+// CheckStyle
+checkstyle {
+    toolVersion = '13.4.1'
+    configFile = file("${rootDir}/config/checkstyle/checkstyle-rules.xml")
+    configProperties = [
+            'suppressionFile': "${rootDir}/config/checkstyle/checkstyle-suppressions.xml"
+    ]
+    maxWarnings = 0
 }
 
+
+// Jib
+jib {
+    from {
+        image = 'eclipse-temurin:21-jre-alpine'
+        platforms {
+            platform {
+                architecture = 'amd64'
+                os = 'linux'
+            }
+        }
+    }
+    container {
+        ports = ['8080']
+        environment = [
+                'TZ': 'Asia/Seoul'
+        ]
+        jvmFlags = ['-Xms256m', '-Xmx512m', '-XX:+UseG1GC']
+        creationTime = 'USE_CURRENT_TIMESTAMP'
+    }
+}
+
+
 tasks.named('test') {
-	useJUnitPlatform()
+    useJUnitPlatform()
 }