deploy.yml

name: Deploy to EC2

on:
  push:
    branches:
      - master

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: GitHub 필수 시크릿 체크
        run: |
          missing=""
          check() {
            if [ -z "$2" ]; then
              missing="$missing $1"
            fi
          }
          check DOCKER_USERNAME "${{ secrets.DOCKER_USERNAME }}"
          check DOCKER_PASSWORD "${{ secrets.DOCKER_PASSWORD }}"
          check EC2_HOST "${{ secrets.EC2_HOST }}"
          check EC2_USER "${{ secrets.EC2_USER }}"
          check EC2_KEY "${{ secrets.EC2_KEY }}"
          if [ -n "$missing" ]; then
            echo "❌ GitHub Actions 실행에 필요한 시크릿 누락:$missing"
            exit 1
          fi
          echo "✅ GitHub Actions 필수 시크릿 확인 완료"

      - name: Docker Hub 로그인
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: 이미지 빌드 & Push
        run: |
          docker build -t ${{ secrets.DOCKER_USERNAME }}/nutrishare:latest .
          docker push ${{ secrets.DOCKER_USERNAME }}/nutrishare:latest

      - name: EC2 배포
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USER }}
          key: ${{ secrets.EC2_KEY }}
          script: |
            cd ~/Spring || exit 1
            git fetch --prune origin master || exit 1
            git checkout master || exit 1
            git reset --hard origin/master || exit 1

            compose() {
              if command -v docker-compose >/dev/null 2>&1; then
                docker-compose "$@"
              else
                docker compose "$@"
              fi
            }

            old_env=.env
            tmp_env=$(mktemp .env.XXXXXX)
            missing_runtime=""
            trap 'rm -f "$tmp_env"' EXIT

            existing_env_value() {
              key="$1"
              if [ -f "$old_env" ]; then
                awk -v key="$key" '
                  index($0, key "=") == 1 {
                    value = substr($0, length(key) + 2)
                    found = 1
                  }
                  END {
                    if (found) {
                      printf "%s", value
                    }
                  }
                ' "$old_env" || true
              fi
              return 0
            }

            write_env() {
              key="$1"
              incoming="$2"
              required="${3:-optional}"

              if [ -n "$incoming" ]; then
                value="$incoming"
                source="github-secret"
              else
                value=$(existing_env_value "$key")
                source="server-env"
              fi

              if [ -z "$(printf '%s' "$value" | tr -d '[:space:]')" ] && [ "$required" = "required" ]; then
                missing_runtime="$missing_runtime $key"
              fi

              printf '%s=%s\n' "$key" "$value" >> "$tmp_env" || exit 1
              echo "${key}: ${source}"
              return 0
            }

            write_env DOCKER_USERNAME "${{ secrets.DOCKER_USERNAME }}" required
            write_env MYSQL_ROOT_PASSWORD "${{ secrets.MYSQL_ROOT_PASSWORD }}" required
            write_env MYSQL_DATABASE "${{ secrets.MYSQL_DATABASE }}" required
            write_env MYSQL_USER "${{ secrets.MYSQL_USER }}" required
            write_env MYSQL_PASSWORD "${{ secrets.MYSQL_PASSWORD }}" required
            write_env DB_URL "${{ secrets.DB_URL }}" required
            write_env DB_USERNAME "${{ secrets.DB_USERNAME }}" required
            write_env DB_PASSWORD "${{ secrets.DB_PASSWORD }}" required
            write_env REDIS_HOST "${{ secrets.REDIS_HOST }}" required
            write_env REDIS_PORT "${{ secrets.REDIS_PORT }}" required
            write_env GOOGLE_CLIENT_ID "${{ secrets.GOOGLE_CLIENT_ID }}" optional
            write_env GOOGLE_CLIENT_SECRET "${{ secrets.GOOGLE_CLIENT_SECRET }}" optional
            write_env KAKAO_CLIENT_ID "${{ secrets.KAKAO_CLIENT_ID }}" optional
            write_env KAKAO_CLIENT_SECRET "${{ secrets.KAKAO_CLIENT_SECRET }}" optional
            write_env KAKAO_ADMIN_KEY "${{ secrets.KAKAO_ADMIN_KEY }}" required
            write_env JWT_SECRET "${{ secrets.JWT_SECRET }}" required
            write_env FRONTEND_URL "${{ secrets.FRONTEND_URL }}" required
            write_env APP_QA_SEED_ENABLED "${{ secrets.APP_QA_SEED_ENABLED }}" optional

            if [ -n "$missing_runtime" ]; then
              echo "❌ GitHub Secret도 없고 EC2 기존 .env에도 없는 런타임 값:$missing_runtime"
              rm -f "$tmp_env"
              exit 1
            fi

            mv "$tmp_env" .env
            trap - EXIT

            compose config >/dev/null || exit 1
            docker pull ${{ secrets.DOCKER_USERNAME }}/nutrishare:latest || exit 1
            compose up -d --force-recreate app || exit 1
            compose exec -T app sh -lc 'test -n "${KAKAO_ADMIN_KEY:-}"' || exit 1
            echo "✅ KAKAO_ADMIN_KEY injected into app container"
            compose ps || exit 1