deploy-dev.yml

name: Deploy Dev

on:
  workflow_dispatch:
  push:
    branches:
      - dev

permissions:
  contents: read
  packages: write

concurrency:
  group: deploy-development
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: devkor-github/ontime-back
  IMAGE_TAG: dev-${{ github.sha }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: ./ontime-back
          file: ./ontime-back/Dockerfile
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev-latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-to-remote-pc:
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: development
    env:
      DEV_DEPLOY_DIR: ${{ secrets.DEV_DEPLOY_DIR || format('/home/{0}/OnTime-back-dev', secrets.DEV_REMOTE_USER) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Prepare dev deploy directory
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.DEV_REMOTE_HOST }}
          username: ${{ secrets.DEV_REMOTE_USER }}
          key: ${{ secrets.DEV_REMOTE_SSH_KEY }}
          script: |
            set -eu
            mkdir -p "${{ env.DEV_DEPLOY_DIR }}"

      - name: Upload compose files to remote PC
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.DEV_REMOTE_HOST }}
          username: ${{ secrets.DEV_REMOTE_USER }}
          key: ${{ secrets.DEV_REMOTE_SSH_KEY }}
          source: "ontime-back/docker-compose.yml,ontime-back/docker-compose.dev.yml"
          target: ${{ env.DEV_DEPLOY_DIR }}
          strip_components: 1

      - name: Pull image and restart dev containers
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.DEV_REMOTE_HOST }}
          username: ${{ secrets.DEV_REMOTE_USER }}
          key: ${{ secrets.DEV_REMOTE_SSH_KEY }}
          script: |
            set -eu

            DEPLOY_DIR="${{ env.DEV_DEPLOY_DIR }}"
            CONTAINER_NAME="ontime-dev-container"

            mkdir -p "$DEPLOY_DIR"
            cd "$DEPLOY_DIR"

            umask 077
            cat > .env <<'EOF'
            IMAGE_TAG=${{ env.IMAGE_TAG }}
            BACKEND_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
            BACKEND_CONTAINER_NAME=ontime-dev-container
            BACKEND_HTTP_PORT=${{ secrets.DEV_BACKEND_HTTP_PORT || '8081' }}
            BACKEND_MEMORY_LIMIT=${{ secrets.DEV_BACKEND_MEMORY_LIMIT || '768m' }}
            BACKEND_CPU_LIMIT=${{ secrets.DEV_BACKEND_CPU_LIMIT || '1.0' }}
            SERVER_PORT=8080
            SPRING_PROFILES_ACTIVE=dev
            JAVA_TOOL_OPTIONS=-XX:InitialRAMPercentage=50.0 -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom

            MYSQL_DATABASE=${{ secrets.DEV_MYSQL_DATABASE || 'ontime_dev' }}
            MYSQL_USER=${{ secrets.DEV_MYSQL_USER || 'ontime_dev' }}
            MYSQL_PASSWORD=${{ secrets.DEV_MYSQL_PASSWORD || 'ontime_dev_password' }}
            MYSQL_ROOT_PASSWORD=${{ secrets.DEV_MYSQL_ROOT_PASSWORD || 'ontime_dev_root_password' }}

            SPRING_APPLICATION_NAME=${{ secrets.DEV_SPRING_APPLICATION_NAME || 'ontime-back-dev' }}
            SPRING_DATASOURCE_URL=${{ secrets.DEV_SPRING_DATASOURCE_URL || 'jdbc:mysql://mysql:3306/ontime_dev?useSSL=false&serverTimezone=Asia/Seoul&characterEncoding=UTF-8&allowPublicKeyRetrieval=true' }}
            SPRING_DATASOURCE_USERNAME=${{ secrets.DEV_SPRING_DATASOURCE_USERNAME || secrets.DEV_MYSQL_USER || 'ontime_dev' }}
            SPRING_DATASOURCE_PASSWORD=${{ secrets.DEV_SPRING_DATASOURCE_PASSWORD || secrets.DEV_MYSQL_PASSWORD || 'ontime_dev_password' }}
            SPRING_DATASOURCE_DRIVER_CLASS_NAME=com.mysql.cj.jdbc.Driver
            SPRING_JPA_HIBERNATE_DDL_AUTO=validate

            SPRING_FLYWAY_ENABLED=true
            SPRING_FLYWAY_BASELINE_ON_MIGRATE=false

            JWT_SECRET_KEY=${{ secrets.DEV_JWT_SECRETKEY || 'dev_secret_key_for_ontime_back_remote_pc_development_1234567890' }}
            JWT_ACCESS_EXPIRATION=${{ secrets.DEV_JWT_ACCESS_EXPIRATION || '3600000' }}
            JWT_REFRESH_EXPIRATION=${{ secrets.DEV_JWT_REFRESH_EXPIRATION || '1209600000' }}
            JWT_ACCESS_HEADER=${{ secrets.DEV_JWT_ACCESS_HEADER || 'Authorization' }}
            JWT_REFRESH_HEADER=${{ secrets.DEV_JWT_REFRESH_HEADER || 'Authorization-refresh' }}

            GOOGLE_WEB_CLIENT_ID=${{ secrets.GOOGLE_WEB_CLIENT_ID || 'dev-google-web-client-id' }}
            GOOGLE_APP_CLIENT_ID=${{ secrets.GOOGLE_APP_CLIENT_ID || 'dev-google-app-client-id' }}

            APPLE_CLIENT_ID=${{ secrets.DEV_APPLE_CLIENT_ID || 'dev-apple-client-id' }}
            APPLE_TEAM_ID=${{ secrets.DEV_APPLE_TEAM_ID || 'dev-apple-team-id' }}
            APPLE_LOGIN_KEY=${{ secrets.DEV_APPLE_LOGIN_KEY || 'dev-apple-key-id' }}
            APPLE_PRIVATE_KEY_BASE64=${{ secrets.DEV_APPLE_PRIVATE_KEY_BASE64 }}
            FEATURE_APPLE_LOGIN_ENABLED=${{ secrets.DEV_FEATURE_APPLE_LOGIN_ENABLED || 'false' }}

            FIREBASE_CREDENTIALS_BASE64=${{ secrets.DEV_FIREBASE_CREDENTIALS_BASE64 }}
            EOF

            echo "${{ secrets.GHCR_READ_TOKEN }}" | sudo docker login ghcr.io -u "${{ secrets.GHCR_USERNAME }}" --password-stdin

            if sudo docker compose version >/dev/null 2>&1; then
              COMPOSE="sudo docker compose"
            else
              COMPOSE="sudo docker-compose"
            fi

            $COMPOSE -f docker-compose.yml -f docker-compose.dev.yml pull
            $COMPOSE -f docker-compose.yml -f docker-compose.dev.yml up -d --remove-orphans

            HEALTHY=false
            for attempt in $(seq 1 30); do
              STATUS="$(sudo docker inspect -f '{{.State.Health.Status}}' "$CONTAINER_NAME" 2>/dev/null || true)"
              if [ "$STATUS" = "healthy" ]; then
                echo "Container is healthy."
                HEALTHY=true
                break
              fi
              echo "Waiting for healthy container status; current status: ${STATUS:-unknown}"
              sleep 5
            done

            if [ "$HEALTHY" != "true" ]; then
              sudo docker logs --tail=200 "$CONTAINER_NAME" || true
              exit 1
            fi

            curl -fsS "http://127.0.0.1:${{ secrets.DEV_BACKEND_HTTP_PORT || '8081' }}/actuator/health/readiness"