program-service/.github/workflows/deploy.yml at dev · first-ticket/program-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: CI/CD - Build, Test, and Deploy

on:
    pull_request:
        branches:
            - main
            - dev
    push:
        branches:
            - main
            - dev
    workflow_dispatch:

permissions:
    id-token: write
    contents: read

env:
    AWS_REGION: ap-northeast-2
    ECR_REPOSITORY: first-ticket/program-service
    GITHUB_USER: ${{ secrets.GH_USER }}
    GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

jobs:
    build-and-test:
        runs-on: ubuntu-latest
        steps:
            -   name: Checkout
                uses: actions/checkout@v6

            -   name: Set up JDK 21
                uses: actions/setup-java@v5
                with:
                    java-version: '21'
                    distribution: 'temurin'

            -   name: Set up Gradle
                uses: gradle/actions/setup-gradle@v6

            -   name: Grant execute permission to gradlew
                run: chmod +x gradlew

            -   name: Build & Test
                run: ./gradlew build --no-daemon

            -   name: Upload test report (on failure)
                if: failure()
                uses: actions/upload-artifact@v5
                with:
                    name: test-report
                    path: build/reports/tests/
                    retention-days: 7

    push-to-ecr:
        needs: build-and-test
        if: |
            github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
        runs-on: ubuntu-latest
        steps:
            -   uses: actions/checkout@v6

            -   name: Configure AWS credentials (OIDC)
                uses: aws-actions/configure-aws-credentials@v6
                with:
                    role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
                    aws-region: ${{ env.AWS_REGION }}

            -   name: Login to Amazon ECR
                id: ecr-login
                uses: aws-actions/amazon-ecr-login@v2

            -   name: Set up Docker Buildx
                uses: docker/setup-buildx-action@v3

            -   name: Build, tag, and push image to ECR
                env:
                    REGISTRY: ${{ steps.ecr-login.outputs.registry }}
                    IMAGE_TAG: ${{ github.sha }}
                    GH_USER: ${{ secrets.GH_USER }}
                    GH_TOKEN: ${{ secrets.GH_TOKEN }}
                run: |
                    docker buildx build --platform linux/amd64 \
                      --build-arg GITHUB_USER="$GH_USER" \
                      --secret id=github_token,src=<(echo "$GH_TOKEN") \
                      -t $REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG \
                      -t $REGISTRY/$ECR_REPOSITORY:latest \
                      --push \
                      .

            -   name: Show pushed image
                run: |
                    echo "✅ Pushed: $ECR_REPOSITORY:${{ github.sha }}"
                    echo "✅ Pushed: $ECR_REPOSITORY:latest"

            -   name: Download task definition
                run: |
                    aws ecs describe-task-definition --task-definition program-service \
                      --query taskDefinition > task-definition.json

            -   name: Deploy to ECS
                uses: aws-actions/amazon-ecs-deploy-task-definition@v2
                with:
                    task-definition: task-definition.json
                    service: program-service
                    cluster: first-ticket-cluster
                    wait-for-service-stability: false