CI/CD: GitHub Actions + Docker

# Multi-stage 빌드
FROM gradle:8.5-jdk21 AS builder
WORKDIR /app
COPY build.gradle settings.gradle ./
COPY src ./src
RUN gradle bootJar --no-daemon


FROM eclipse-temurin:21-jre-alpine
WORKDIR /app

# 보안 — 비루트 사용자
RUN addgroup -g 1000 spring && adduser -D -G spring -u 1000 spring
USER spring

COPY --from=builder /app/build/libs/*.jar app.jar

EXPOSE 8080

# 헬스체크
HEALTHCHECK --interval=30s --timeout=3s --start-period=60s \
    CMD wget --quiet --tries=1 --spider http://localhost:8080/actuator/health/liveness || exit 1

ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]

version: '3.8'

services:
  app:
    build: .
    ports:
      - "8080:8080"
    environment:
      SPRING_PROFILES_ACTIVE: dev
      DB_URL: jdbc:postgresql://postgres:5432/dev
      DB_USERNAME: dev
      DB_PASSWORD: dev
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: dev
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "dev"]

  redis:
    image: redis:7-alpine

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ hashFiles('**/build.gradle*') }}
      - name: Test
        run: ./gradlew test jacocoTestReport
      - name: Upload coverage
        uses: codecov/codecov-action@v4

  build-and-deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-northeast-2

      - name: Login to ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: |
            ${{ steps.ecr.outputs.registry }}/ohs-backend:${{ github.sha }}
            ${{ steps.ecr.outputs.registry }}/ohs-backend:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Deploy to ECS
        run: |
          aws ecs update-service \
            --cluster ohs-prod \
            --service ohs-backend \
            --force-new-deployment

      - name: Notify Slack
        if: always()
        uses: 8398a7/action-slack@v3
        with:
          status: ${{ job.status }}
          webhook_url: ${{ secrets.SLACK_WEBHOOK }}

# AWS CodeDeploy 설정
{
    "applicationName": "ohs-backend",
    "deploymentGroupName": "production",
    "deploymentConfig": "CodeDeployDefault.ECSCanary10Percent5Minutes",
    # 10% 트래픽 5분 → 100%
}