[PR이전][BUILD] 배포 자동화 세팅

.dockerignore

@@ -0,0 +1,35 @@
+.git
+.github
+.gitignore
+.idea
+.vscode
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+env/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+coverage.xml
+tests/
+test-sites/
+docs/
+*.md
+.env
+.env.*
+data/
+*.db
+*.db-journal
+*.db-wal
+*.db-shm
+*.log
+logs/
+node_modules/
+.DS_Store
+Dockerfile
+.dockerignore
+.pre-commit-config.yaml
+Makefile

.github/workflows/cd.yml

@@ -0,0 +1,80 @@
+name: CD
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:   # 수동 실행 (테스트/재배포/롤백)
+
+permissions:
+  id-token: write   # OIDC
+  contents: read
+
+jobs:
+  build-and-push:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.vars.outputs.sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+      - id: vars
+        run: echo "sha=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ vars.IMAGE_NAME }}:latest
+            ${{ vars.IMAGE_NAME }}:${{ steps.vars.outputs.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - name: Deploy via SSM SendCommand
+        run: |
+          cmd_id=$(aws ssm send-command \
+            --instance-ids "${{ secrets.APP_INSTANCE_ID }}" \
+            --document-name "AWS-RunShellScript" \
+            --comment "deploy fastapi ${{ needs.build-and-push.outputs.sha }}" \
+            --parameters commands='[
+              "set -e",
+              "cd ${{ vars.DEPLOY_DIR }}",
+              "docker compose pull ${{ vars.DEPLOY_SERVICE }}",
+              "docker compose up -d ${{ vars.DEPLOY_SERVICE }}",
+              "docker image prune -f"
+            ]' \
+            --query "Command.CommandId" --output text)
+          echo "CommandId=$cmd_id"
+          # 완료까지 폴링 후 상태 검증
+          for i in $(seq 1 30); do
+            status=$(aws ssm get-command-invocation \
+              --command-id "$cmd_id" \
+              --instance-id "${{ secrets.APP_INSTANCE_ID }}" \
+              --query "Status" --output text 2>/dev/null || echo Pending)
+            echo "status=$status"
+            case "$status" in
+              Success) break ;;
+              Failed|Cancelled|TimedOut)
+                aws ssm get-command-invocation --command-id "$cmd_id" \
+                  --instance-id "${{ secrets.APP_INSTANCE_ID }}" \
+                  --query "StandardErrorContent" --output text
+                exit 1 ;;
+            esac
+            sleep 10
+          done

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [dev]
+  push:
+    branches: [dev, main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    env:
+      TLDEXTRACT_CACHE: /tmp/tldextract   # 리눅스 러너 캐시 경로 보정
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: pip
+      - run: pip install -e ".[dev]"
+      - name: Ruff lint
+        run: ruff check app tests
+      - name: Ruff format check
+        run: ruff format --check app tests
+      - name: Mypy
+        run: mypy app
+      - name: Pytest
+        run: pytest

Dockerfile

@@ -0,0 +1,37 @@
+FROM python:3.11-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    # app 이 site-packages 에 설치돼 alembic/uvicorn 이 그쪽을 import 하므로
+    # SQLite 경로를 절대경로로 고정 (PROJECT_ROOT 추론이 site-packages 를 가리켜
+    # 쓰기 불가 위치에 DB 디렉토리를 만들려다 실패하는 문제 방지).
+    SQLITE_PATH=/app/data/linclean.db \
+    TLDEXTRACT_CACHE=/tmp/tldextract
+
+WORKDIR /app
+
+# hatchling 이 app 패키지를 빌드해야 하므로 install 전에 소스 복사
+COPY pyproject.toml ./
+COPY app ./app
+RUN pip install .
+
+# 마이그레이션 + 기동 스크립트
+COPY alembic.ini ./
+COPY alembic ./alembic
+COPY entrypoint.sh ./
+RUN chmod +x entrypoint.sh
+
+# non-root + 데이터 디렉토리(SQLite) 소유권
+RUN useradd -m -u 1000 appuser \
+    && mkdir -p /app/data \
+    && chown -R appuser:appuser /app
+USER appuser
+
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=20s --retries=3 \
+    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health').status==200 else 1)"
+
+ENTRYPOINT ["./entrypoint.sh"]

entrypoint.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+alembic upgrade head
+exec uvicorn app.main:app --host 0.0.0.0 --port 8000