CI/CD 구조와 자동화 — GitHub Actions와 GitOps

name: Build & Push to ECR
 
on:
  push:
    branches: [main]
    tags: ['v*']
 
env:
  AWS_REGION: ap-northeast-2
  ECR_REGISTRY: 505947591451.dkr.ecr.ap-northeast-2.amazonaws.com
  ECR_REPOSITORY: meeny/backend
 
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC로 AWS 인증
      contents: read
 
    steps:
      - uses: actions/checkout@v4
 
      - name: AWS 자격증명 (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::505947591451:role/GitHubActionsECRPushRole
          aws-region: ${{ env.AWS_REGION }}
 
      - name: ECR 로그인
        uses: aws-actions/amazon-ecr-login@v2
 
      - name: 태그 결정
        id: tag
        run: |
          SHORT_SHA=${GITHUB_SHA::7}
          echo "image_tag=git-${SHORT_SHA}" >> $GITHUB_OUTPUT
 
      - name: buildx 셋업
        uses: docker/setup-buildx-action@v3
 
      - name: 빌드 + Push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ steps.tag.outputs.image_tag }}
            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
 
      - name: 배포 저장소 업데이트 (GitOps)
        uses: actions/checkout@v4
        with:
          repository: meeny-org/meeny-deploy
          token: ${{ secrets.DEPLOY_REPO_PAT }}
          path: deploy
 
      - name: values.yaml 이미지 태그 패치
        run: |
          cd deploy/helm/backend
          yq -i '.image.tag = "${{ steps.tag.outputs.image_tag }}"' values-dev.yaml
          git config user.name "github-actions"
          git config user.email "actions@github.com"
          git commit -am "chore(backend): bump image to ${{ steps.tag.outputs.image_tag }}"
          git push

helm repo add argo https://argoproj.github.io/argo-helm
helm install argocd argo/argo-cd \
  -n argocd --create-namespace \
  --set server.service.type=LoadBalancer

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: backend
  namespace: argocd
spec:
  project: default
 
  source:
    repoURL: https://github.com/meeny-org/meeny-deploy.git
    targetRevision: main
    path: helm/backend
    helm:
      valueFiles:
        - values.yaml
        - values-prod.yaml
 
  destination:
    server: https://kubernetes.default.svc
    namespace: backend
 
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

replicaCount: 4
springProfilesActive: prod
resources:
  requests: { cpu: 1000m, memory: 1Gi }
  limits:   { cpu: 2000m, memory: 2Gi }

# Terraform 예시
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}
 
resource "aws_iam_role" "github_ecr_push" {
  name = "GitHubActionsECRPushRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = { Federated = aws_iam_openid_connect_provider.github.arn }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringLike = {
          "token.actions.githubusercontent.com:sub" = "repo:meeny-org/*:*"
        }
      }
    }]
  })
}

aws ecr put-lifecycle-policy --repository-name meeny/backend \
  --lifecycle-policy-text '{
    "rules": [{
      "rulePriority": 1,
      "description": "Keep last 30 images",
      "selection": {
        "tagStatus": "any",
        "countType": "imageCountMoreThan",
        "countNumber": 30
      },
      "action": { "type": "expire" }
    }]
  }'