Skip to content

[#9] CICD: Gradle 빌드/Docker 배포 자동화를 위한 workflow.yml 추가 #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Yujin1219 merged 1 commit into from
Dec 9, 2025
Merged

[#9] CICD: Gradle 빌드/Docker 배포 자동화를 위한 workflow.yml 추가 #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 101 additions & 0 deletions .github/workflows/workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
name: TripTalk CI/CD with Gradle, Test, and Docker

on:
workflow_dispatch:
push:
branches: [ "develop" ]
pull_request:
branches: [ "develop" ]

permissions:
contents: read

jobs:
CI-CD:
runs-on: ubuntu-latest
permissions:
contents: read

steps:
# 1. 코드 체크아웃
- uses: actions/checkout@v4

# 2. JDK 21 설정
- name: Set up JDK 21
uses: actions/setup-java@v4
with:
java-version: '21'
distribution: 'temurin'

# 3. Gradle 캐시
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v3
with:
path: |
~/.gradle/caches
~/.gradle/wrapper
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
restore-keys: |
${{ runner.os }}-gradle-

# 4. application.yml 생성
- name: Make application.yml from Secret
run: |
mkdir -p ./src/main/resources
echo "${{ secrets.APPLICATION_DEV_YML_BASE64 }}" | base64 --decode > ./src/main/resources/application.yml
echo "=== [DEBUG] application.yml ==="
cat ./src/main/resources/application.yml
Comment on lines +41 to +47
Copy link

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

⚠️ application.yml을 로그에 노출하고 있습니다 - 민감한 정보가 유출될 위험

설정 파일의 전체 내용을 워크플로우 로그에 출력하면 데이터베이스 비밀번호, API 키, 토큰 등 민감한 정보가 노출됩니다. GitHub 로그는 기본적으로 공개되므로 보안 위험이 매우 높습니다.

디버그 출력(46-47줄)을 제거해야 합니다.

  - name: Make application.yml from Secret
    run: |
      mkdir -p ./src/main/resources
      echo "${{ secrets.APPLICATION_DEV_YML_BASE64 }}" | base64 --decode > ./src/main/resources/application.yml
-     echo "=== [DEBUG] application.yml ==="
-     cat ./src/main/resources/application.yml
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# 4. application.yml 생성
- name: Make application.yml from Secret
run: |
mkdir -p ./src/main/resources
echo "${{ secrets.APPLICATION_DEV_YML_BASE64 }}" | base64 --decode > ./src/main/resources/application.yml
echo "=== [DEBUG] application.yml ==="
cat ./src/main/resources/application.yml
# 4. application.yml 생성
- name: Make application.yml from Secret
run: |
mkdir -p ./src/main/resources
echo "${{ secrets.APPLICATION_DEV_YML_BASE64 }}" | base64 --decode > ./src/main/resources/application.yml
🤖 Prompt for AI Agents 
.github/workflows/workflow.yml around lines 41 to 47: the workflow currently
writes application.yml from a base64 secret and then prints its full contents to
the log (lines 46-47), exposing sensitive credentials; remove the debug/print
steps that output the file contents (the echo "=== [DEBUG] application.yml ==="
and the cat command) so the secret is not logged, and if you need to verify
creation retain only non-sensitive checks (e.g., test file existence or size)
without printing file content.


# 5. gradlew 권한 부여
- name: Grant Execute Permission For Gradlew
run: chmod +x gradlew

# 6. Gradle build
- name: Build Gradle (without test)
run: ./gradlew bootJar -x test

# 7. Docker Build & Push
- name: Docker Build & Push
run: |
docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
docker build -t ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest .
docker push ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest
Comment on lines +58 to +62
Copy link

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Docker 로그인 시 보안 모범 사례를 따르세요

현재 방식은 docker login 커맨드에 비밀번호를 직접 전달하고 있어 쉘 히스토리와 로그에 노출될 수 있습니다. 공식 Docker GitHub Actions를 사용하면 자격증명이 안전하게 처리됩니다.

      # 7. Docker Build & Push
-     - name: Docker Build & Push
-       run: |
-         docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
-         docker build -t ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest .
-         docker push ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest
+     - name: Log in to Docker Hub
+       uses: docker/login-action@v3
+       with:
+         username: ${{ secrets.DOCKER_USERNAME }}
+         password: ${{ secrets.DOCKER_PASSWORD }}
+
+     - name: Build and push Docker image
+       uses: docker/build-push-action@v5
+       with:
+         push: true
+         tags: ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Docker Build & Push
run: |
docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
docker build -t ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest .
docker push ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
push: true
tags: ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest
🤖 Prompt for AI Agents 
.github/workflows/workflow.yml around lines 58-62: current step runs `docker
login` with the password on the command line which can leak credentials; replace
the manual login with the official GitHub Action (docker/login-action) to
authenticate using secrets, then either use docker/build-push-action to build
and push in a single step or remove the manual `docker login` before calling
`docker build`/`docker push`; update the job to call - uses:
docker/login-action@v2 with with: username: ${{ secrets.DOCKER_USERNAME }} and
password: ${{ secrets.DOCKER_PASSWORD }} (and switch to uses:
docker/build-push-action@v4 with appropriate with: context, push: true, tags:
...) so credentials are handled securely and not exposed in logs.


# 8. 서버 배포 (Dev 서버)
- name: Deploy to Dev
uses: appleboy/ssh-action@master
if: contains(github.ref,'develop')
with:
key: ${{ secrets.PRIVATE_KEY }}
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
port: 22
script: |
cd ~/app

# 기존 컨테이너 정리
docker-compose -f docker-compose.yml down || true

# 최신 이미지 pull
docker pull ${{ secrets.DOCKER_USERNAME }}/triptalk-spring:latest

# 컨테이너 재시작
docker-compose -f docker-compose.yml up -d --remove-orphans

# 사용하지 않는 이미지 삭제
docker image prune -f

# 9. 현재 시간 출력
current-time:
needs: CI-CD
runs-on: ubuntu-latest
steps:
- name: Get Current Time
uses: 1466587594/get-current-time@v2
id: current-time
with:
format: YYYY-MM-DDTHH:mm:ss
utcOffset: "+09:00"

- name: Print Current Time
run: echo "Current Time=${{steps.current-time.outputs.formattedTime}}"
Comment on lines +88 to +101
Copy link

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

불필요한 작업을 제거하세요

current-time 작업은 워크플로우 실행 후 현재 시간을 출력하는 것만 하며, 실제 CI/CD 파이프라인에 기능적 가치를 제공하지 않습니다. 또한 외부 액션에 대한 불필요한 의존성을 추가합니다. 이 작업을 제거하는 것이 좋습니다.

      - name: Print Current Time
        run: echo "Current Time=${{steps.current-time.outputs.formattedTime}}"
-
- # 9. 현재 시간 출력
- current-time:
-   needs: CI-CD
-   runs-on: ubuntu-latest
-   steps:
-     - name: Get Current Time
-       uses: 1466587594/get-current-time@v2
-       id: current-time
-       with:
-         format: YYYY-MM-DDTHH:mm:ss
-         utcOffset: "+09:00"
-
-     - name: Print Current Time
-       run: echo "Current Time=${{steps.current-time.outputs.formattedTime}}"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# 9. 현재 시간 출력
current-time:
needs: CI-CD
runs-on: ubuntu-latest
steps:
- name: Get Current Time
uses: 1466587594/get-current-time@v2
id: current-time
with:
format: YYYY-MM-DDTHH:mm:ss
utcOffset: "+09:00"
- name: Print Current Time
run: echo "Current Time=${{steps.current-time.outputs.formattedTime}}"
# Other jobs...
🤖 Prompt for AI Agents 
.github/workflows/workflow.yml around lines 88 to 101: the reviewer says the
"current-time" job is unnecessary and adds an external dependency; remove the
entire "current-time" job block (including its steps) from the workflow and
ensure no other jobs list it in their "needs" arrays or depend on its outputs;
if any job references needs: current-time or uses outputs from that job, update
those jobs to remove that dependency or replace the dependency with the correct
one so the workflow DAG remains valid.

Loading