CI CI/CD 완전 가이드

name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm test -- --runInBand
        if: ${{ hashFiles('**/*.test.ts', '**/*.spec.ts') != '' }}

  deploy:
    needs: build-test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        run: ./scripts/deploy.sh
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

pipeline {
  agent any

  environment {
    NODE_VERSION = '22'
    IMAGE_NAME = 'registry.example.com/aidevops-agent'
    IMAGE_TAG = "${env.GIT_COMMIT}"
  }

  options {
    timestamps()
    disableConcurrentBuilds()
    buildDiscarder(logRotator(numToKeepStr: '20'))
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }

    stage('Install') {
      steps {
        sh 'node --version'
        sh 'npm ci'
      }
    }

    stage('Build') {
      steps {
        sh 'npm run build'
      }
    }

    stage('Test') {
      steps {
        sh 'npm test -- --runInBand || true'
        sh 'bash scripts/ci-smoke.sh'
      }
    }

    stage('Docker Build') {
      steps {
        sh 'docker build -t $IMAGE_NAME:$IMAGE_TAG -t $IMAGE_NAME:latest .'
      }
    }

    stage('Docker Push') {
      when { branch 'main' }
      steps {
        withCredentials([usernamePassword(
          credentialsId: 'container-registry',
          usernameVariable: 'REGISTRY_USER',
          passwordVariable: 'REGISTRY_PASSWORD'
        )]) {
          sh 'echo $REGISTRY_PASSWORD | docker login registry.example.com -u $REGISTRY_USER --password-stdin'
          sh 'docker push $IMAGE_NAME:$IMAGE_TAG'
          sh 'docker push $IMAGE_NAME:latest'
        }
      }
    }

    stage('Deploy Staging') {
      when { branch 'main' }
      steps {
        sh 'ssh deploy@staging "cd /opt/aidevops-agent && docker compose pull && docker compose up -d"'
        sh 'BASE_URL=https://staging.example.com bash scripts/ci-smoke.sh'
      }
    }

    stage('Approve Production') {
      when { branch 'main' }
      steps {
        input message: 'Deploy to production?', ok: 'Deploy'
      }
    }

    stage('Deploy Production') {
      when { branch 'main' }
      steps {
        sh 'ssh deploy@prod "cd /opt/aidevops-agent && docker compose pull && docker compose up -d"'
        sh 'BASE_URL=https://www.aidevops.kr bash scripts/ci-smoke.sh'
      }
    }
  }

  post {
    failure {
      echo 'Pipeline failed. Check build logs and rollback if production deploy started.'
    }
    always {
      sh 'docker image prune -f || true'
    }
  }
}

jobs:
  test:
    strategy:
      matrix:
        shard: [1, 2, 3, 4]   # 테스트를 4개로 쪼개 동시에 실행
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm           # package-lock.json 해시 기준 자동 캐싱
      - run: npm ci
      - run: npm test -- --shard=${{ matrix.shard }}/4

name: Docker Image

on:
  push:
    branches: [main]

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}/aidevops-agent

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

permissions:
  id-token: write   # OIDC 토큰 발급에 필요
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deployer
          aws-region: ap-northeast-2
          # AWS_ACCESS_KEY_ID/SECRET 없이 여기서 임시 자격 증명이 발급됨
      - run: aws ecs update-service --cluster prod --service api --force-new-deployment

permissions:
  contents: read
  packages: write
  id-token: write   # keyless 서명에 필요

steps:
  - uses: docker/build-push-action@v6
    id: build
    with:
      push: true
      tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}
      sbom: true             # SBOM을 이미지에 함께 첨부

  - uses: sigstore/cosign-installer@v3
  - name: 이미지 서명 (keyless — GitHub OIDC 신원으로 서명)
    run: cosign sign --yes ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

jobs:
  plan:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init
      - run: terraform plan -out=tfplan   # 결과를 PR 코멘트로 게시

  apply:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init
      - run: terraform apply -auto-approve
      - run: ansible-playbook -i inventory/prod.ini deploy.yml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/myapp-manifests.git
    targetRevision: main
    path: overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true       # Git에서 삭제된 리소스는 클러스터에서도 자동 삭제
      selfHeal: true     # 누군가 kubectl로 수동 변경해도 Git 상태로 자동 복원