chore/KD-58: AWS 개발 서버 CD를 위한 workflow 추가 #307
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 개요새로운 GitHub Actions 워크플로우를 도입하여 세 개의 Docker 이미지(aics-admin, aics-api, aics-auth)를 빌드한 후 docker-compose를 통해 개발 서버에 배포하는 CI/CD 파이프라인을 구성합니다. 변경 사항
예상 코드 리뷰 노력🎯 2 (Simple) | ⏱️ ~12 분 관련 가능성 있는 PR
제안 검토자
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Test Coverage Report
|
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## develop #307 +/- ##
==========================================
Coverage 86.51% 86.51%
Complexity 67 67
==========================================
Files 24 24
Lines 267 267
Branches 14 14
==========================================
Hits 231 231
Misses 24 24
Partials 12 12 Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
.github/workflows/cloud-dev-build-deploy.yml (2)
29-33: Gradle 빌드 로직이 올바릅니다.세 개의 프로젝트를 개별적으로 빌드하는 로직이 명확하고 정확합니다.
선택적 개선: 매트릭스 전략 사용
향후 프로젝트가 추가될 경우 매트릭스 전략을 고려할 수 있습니다:
strategy: matrix: module: [aics-admin, aics-api, aics-auth] steps: - name: Build with Gradle Wrapper run: ./gradlew clean build -p ${{ matrix.module }} -x test하지만 현재 구현도 충분히 명확합니다.
43-72: Docker 이미지 빌드 및 푸시 로직이 올바릅니다.각 서비스에 대해 SHA와 latest 태그를 모두 생성하는 접근 방식이 적절합니다. SHA 태그는 추적성을, latest 태그는 편의성을 제공합니다.
선택적 개선: 반복 코드 감소
향후 유지보수성을 위해 매트릭스 전략을 사용하거나, 세 개의 이미지를 한 번에 처리하는 스크립트를 고려할 수 있습니다. 하지만 현재 구현도 명확하고 이해하기 쉽습니다.
📜 Review details
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/cloud-dev-build-deploy.yml
🧰 Additional context used
🪛 actionlint (1.7.9)
.github/workflows/cloud-dev-build-deploy.yml
16-16: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
37-37: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
81-81: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (2)
.github/workflows/cloud-dev-build-deploy.yml (2)
3-7: 워크플로우 트리거 설정이 적절합니다.develop 브랜치로의 push와 수동 실행을 모두 지원하는 설정이 올바르게 구성되어 있습니다.
83-92: SCP 단계가 올바르게 구성되었습니다.docker-compose.yml 파일을 서버로 전송하는 설정이 적절하며,
strip_components: 2를 통해 경로 구조를 올바르게 처리하고 있습니다.
|
|
||
| steps: | ||
| - name: get repo from github | ||
| uses: actions/checkout@v3 |
There was a problem hiding this comment.
액션 버전을 업데이트하세요.
actions/checkout@v3는 구버전입니다. GitHub Actions에서 더 이상 지원하지 않는 Node.js 버전을 사용합니다.
🔎 제안된 수정사항
- uses: actions/checkout@v3
+ uses: actions/checkout@v4정적 분석 도구에 따름.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.9)
16-16: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
.github/workflows/cloud-dev-build-deploy.yml around line 16: the workflow uses
actions/checkout@v3 which is an older major version that can pull in unsupported
Node runtimes; update the action reference to the current stable major (e.g.,
actions/checkout@v4) in the workflow file, run a quick CI pass to confirm
compatibility, and adjust any workflow inputs if the new major changed defaults.
| uses: docker/login-action@v2 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_PASSWORD }} |
There was a problem hiding this comment.
Docker 로그인 액션 버전을 업데이트하세요.
docker/login-action@v2는 구버전입니다. GitHub Actions에서 더 이상 지원하지 않는 Node.js 버전을 사용합니다.
🔎 제안된 수정사항
- uses: docker/login-action@v2
+ uses: docker/login-action@v3정적 분석 도구에 따름.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} |
🧰 Tools
🪛 actionlint (1.7.9)
37-37: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
.github/workflows/cloud-dev-build-deploy.yml lines 37-40: the workflow uses the
legacy docker/login-action@v2 which relies on an unsupported Node.js runtime;
update the action reference to the current major release (e.g.,
docker/login-action@v3) by replacing the uses line, keep the username/password
secrets as-is, and run the workflow to verify login succeeds and no Node runtime
warnings/errors remain.
|
|
||
| steps: | ||
| - name: checkout repository | ||
| uses: actions/checkout@v3 |
There was a problem hiding this comment.
액션 버전을 업데이트하세요.
actions/checkout@v3는 구버전입니다. v4로 업데이트해야 합니다.
🔎 제안된 수정사항
- uses: actions/checkout@v3
+ uses: actions/checkout@v4정적 분석 도구에 따름.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.9)
81-81: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
.github/workflows/cloud-dev-build-deploy.yml around line 81: the workflow uses
actions/checkout@v3 which is outdated; update the step to use
actions/checkout@v4 by changing the action reference to v4, verify there are no
deprecated inputs or breaking changes for v4 in this workflow, and run the
workflow locally or in a branch to confirm it still checks out repository and
passes CI.
| - name: ssh to server and deploy | ||
| uses: appleboy/ssh-action@v1.1.0 | ||
| with: | ||
| host: ${{ secrets.SERVER_HOST }} | ||
| username: ${{ secrets.SERVER_USERNAME }} | ||
| key: ${{ secrets.SSH_PRIVATE_KEY }} | ||
| port: ${{ secrets.SERVER_PORT }} | ||
| script: | | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-api | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-admin | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-auth | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-api | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-admin | ||
| echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-auth No newline at end of file |
There was a problem hiding this comment.
심각한 보안 취약점 및 로직 오류를 수정하세요.
Lines 102-108에서 echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S 명령은 여러 문제가 있습니다:
- 보안 취약점: SSH 개인 키가 로그에 노출될 수 있습니다
- 로직 오류:
sudo -S는 비밀번호를 기대하지만, SSH 개인 키는 비밀번호가 아닙니다. 이 명령은 실패할 가능성이 높습니다 - 근본적인 오해: SSH 개인 키와 sudo 비밀번호는 완전히 다른 인증 방식입니다
권장 해결 방법:
-
최선책: 배포 사용자에 대해 서버에서 passwordless sudo를 설정:
# 서버의 /etc/sudoers.d/deploy-user 파일에 추가 deploy-user ALL=(ALL) NOPASSWD: /usr/bin/docker-compose -
대안: sudo 비밀번호가 필요한 경우, 별도의
SUDO_PASSWORDsecret을 생성하고 사용:script: | echo "${{ secrets.SUDO_PASSWORD }}" | sudo -S docker-compose ...
🔎 passwordless sudo를 사용하는 제안된 수정사항
script: |
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-api
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-admin
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-auth
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-api
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-admin
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-auth
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-api
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-admin
- echo "${{ secrets.SSH_PRIVATE_KEY }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-auth
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-api
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-admin
+ sudo docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml --env-file ${{ secrets.ENVIRONMENT_PATH }} up -d aics-auth중요: 이 수정을 적용하기 전에 EC2 서버에서 배포 사용자에 대한 passwordless sudo를 설정해야 합니다.
🤖 Prompt for AI Agents
.github/workflows/cloud-dev-build-deploy.yml lines 94-108: the workflow is
incorrectly echoing the SSH private key into sudo -S (which both leaks the
secret and misuses sudo), so remove any echo of the SSH key, stop passing
secrets into sudo -S, and update the deploy steps to use one of two safe
approaches: (A) configure the remote deploy user for passwordless sudo for
docker-compose (add an appropriate /etc/sudoers.d entry on the server) and call
sudo docker-compose ... without -S and without echoing secrets, or (B) if
passworded sudo is required, create a separate GitHub secret SUDO_PASSWORD and
echo that secret into sudo -S (not the SSH key) while keeping the
SSH_PRIVATE_KEY only for SSH authentication via the action; also ensure the
ssh-action uses the SSH_PRIVATE_KEY input only for connection and that no
private key is printed or stored in logs.
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
had a problem deploying
to
cloud-dev
GitHub Actions
Failure
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
changed the title
| echo "${{ secrets.SERVER_PASSWORD }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-api | ||
| echo "${{ secrets.SERVER_PASSWORD }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-admin | ||
| echo "${{ secrets.SERVER_PASSWORD }}" | sudo -S docker-compose -f ${{ secrets.DOCKER_COMPOSE_YAML_PATH }}/docker-compose.yml pull aics-auth | ||
| set -euo pipefail |
|
|
||
| private static final Map<String, String> PROFILE_SERVER_URL_MAP = Map.of( | ||
| "dev", "https://aics-admin.ummdev.com", | ||
| "dev", "http://52.79.164.36:8081", |
There was a problem hiding this comment.
음 public ip가 외부로 드러나는게 좋은 상황은 아닌거 같아요.
환경변수 처리하거나 dns로 대체하는게 어떨까요?
| "http://52.79.164.36:8080", | ||
| "http://52.79.164.36:8081", | ||
| "http://52.79.164.36:8082", |
There was a problem hiding this comment.
cors address도 사실 외부에서 주입 받으면 좋을듯요
- 보안 이슈
- 하드 코딩 의존성
보통 이 두가지 때문에 yaml로 빼거나 환경변수로 분리하는 것 같아요
# Conflicts: # .github/workflows/cloud-dev-build-deploy.yml
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
JangYeongHu
temporarily deployed
to
cloud-dev
GitHub Actions
Inactive
Summary
기존에 개인 서버로 운영되었던 개발 서버를 클라우드로 이전합니다.
Tasks
To Reviewer
Github Action과 Workflow 파일을 덮어쓰는 것이 아니라 파일을 신규 작성하여 충분한 테스트 후 기존 Action을 삭제하는 방식으로 리팩토링 할 계획입니다.