core/.github/workflows/ci.yml at dev · TeamPiKi/core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: CI

on:
  push:
    branches: [dev, main]
  pull_request:
    types: [opened, synchronize]
    branches: [dev, main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Checkout extraction contract
        uses: actions/checkout@v4
        with:
          repository: TeamPiKi/infra
          ref: main
          path: shared-infra
          sparse-checkout: contracts
          persist-credentials: false

      - uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: 'temurin'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', '**/gradle-wrapper.properties') }}
          restore-keys: gradle-${{ runner.os }}-

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Build
        run: ./gradlew assemble --no-daemon

      # deploy.yml 이 workflow_run 으로 이 JAR 을 받아 쓴다. PR 은 배포가 없어 push 일 때만 올린다.
      - name: Upload JAR artifact
        if: github.event_name == 'push'
        uses: TeamPiKi/infra/.github/actions/app-jar-upload@main

  test:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v4

      - name: Checkout extraction contract
        uses: actions/checkout@v4
        with:
          repository: TeamPiKi/infra
          ref: main
          path: shared-infra
          sparse-checkout: contracts
          persist-credentials: false

      - uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: 'temurin'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', '**/gradle-wrapper.properties') }}
          restore-keys: gradle-${{ runner.os }}-

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Test
        run: ./gradlew test --no-daemon

      - name: Report test results
        if: always()
        uses: dorny/test-reporter@v1
        with:
          name: Test Results
          path: build/test-results/**/*.xml
          reporter: java-junit
          fail-on-error: false

  # nginx conf 문법 검증 — 깨진 conf 가 dev 에 머지된 뒤 배포(deploy.yml)에서야 nginx -t 로
  # 걸려 롤백되던 걸, PR 단계에서 미리 막는다. infra/nginx 변경이 없는 PR 도 수초면 통과하므로
  # path filter 없이 항상 돌려 required check 로 걸어도 skip 함정이 없게 한다.
  nginx-validate:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      # conf 는 http{} 안에서 include 되는 partial 이고, SSL 인증서·upstream include 가 런타임
      # 의존이라 그대로는 단독 검증이 안 된다. 우회: http 컨텍스트 래퍼로 감싸고, SSL·letsencrypt
      # 라인을 제거(listen 443 ssl[...] → 평문 8443: prod 는 http2, dev 는 없는 형식 둘 다 커버),
      # upstream include 는 더미로 마운트한다. 실제 인증서 검증은 배포 시 deploy.yml 이 EC2 에서 한다.
      - name: Validate nginx configs
        run: |
          set -e
          for conf in infra/nginx/*.conf; do
            echo "::group::validate $conf"
            work=$(mktemp -d)
            sed -e 's/listen 443 ssl[^;]*;/listen 8443;/' \
                -e '/ssl_certificate/d' -e '/ssl_dhparam/d' -e '/include \/etc\/letsencrypt/d' \
                "$conf" > "$work/site.conf"
            echo 'server 127.0.0.1:8080;' > "$work/piki-upstream.conf"
            printf 'events {}\nhttp {\n  include /work/site.conf;\n}\n' > "$work/nginx.conf"
            docker run --rm \
              -v "$work/nginx.conf:/work/nginx.conf:ro" \
              -v "$work/site.conf:/work/site.conf:ro" \
              -v "$work/piki-upstream.conf:/etc/nginx/piki-upstream.conf:ro" \
              nginx:alpine nginx -t -c /work/nginx.conf
            echo "::endgroup::"
          done

      # 기본 설정은 사이트 조각이 아니라 nginx.conf 자체다. alpine 이미지에는 www-data 사용자가 없어 user 줄만 바꾼다.
      - name: Validate nginx main config
        run: |
          set -e
          work=$(mktemp -d)
          sed 's/^user www-data;/user nginx;/' infra/nginx/main/nginx.conf > "$work/nginx.conf"
          docker run --rm -v "$work/nginx.conf:/etc/nginx/nginx.conf:ro" nginx:alpine nginx -t