Docker + GitHub Actions CI/CD 완전 가이드 -- Dockerfile부터 자동 배포까지

# 이미지 관련
docker build -t myapp:1.0 .          # 이미지 빌드
docker images                         # 이미지 목록
docker pull node:24-alpine            # 이미지 다운로드

# 컨테이너 관련
docker run -d -p 3000:3000 myapp:1.0  # 백그라운드 실행 + 포트 매핑
docker ps                             # 실행 중 컨테이너 목록
docker logs -f container_id           # 로그 실시간 출력
docker exec -it container_id bash     # 컨테이너 내부 접속

# 1단계: 의존성 설치 (devDependencies 포함 -- 빌드 도구 필요)
FROM node:24-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci

# 2단계: 빌드 스테이지
FROM node:24-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
RUN npm prune --omit=dev   # 런타임용 production 의존성만 남김

# 3단계: 런타임 스테이지 (production 의존성만)
FROM node:24-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
    CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "dist/index.js"]

version: '3.9'

services:
  app:
    build:
      context: .
      target: runner
    image: myapp:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    depends_on:
      db:
        condition: service_healthy
    networks:
      - app-net

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d mydb"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - app-net

  cache:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - app-net

volumes:
  postgres-data:

networks:
  app-net:
    driver: bridge

name: CI - 린트 & 테스트

on:
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Node.js 설정 (러너 기본 Node 24)
        uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm test

name: CD - 빌드 & 배포

on:
  push:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write        # GHCR 푸시
      id-token: write         # OIDC 키리스 + 프로버넌스 서명
      attestations: write     # 빌드 프로버넌스 attestation
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v5

      - name: Docker Buildx 설정
        uses: docker/setup-buildx-action@v3

      - name: GHCR 로그인 (내장 GITHUB_TOKEN)
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 태그 & 라벨 메타데이터
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=ref,event=branch
            type=raw,value=latest,enable={{is_default_branch}}

      - name: 빌드 & 푸시 (멀티 아키텍처 + GHA 캐시)
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: 빌드 프로버넌스 서명
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # AWS OIDC 키리스 인증
      contents: read
    steps:
      - name: AWS 자격증명 (OIDC, 장기 키 없음)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ap-northeast-2

      - name: ECS 서비스 강제 재배포
        run: |
          aws ecs update-service \
            --cluster prod \
            --service myapp \
            --force-new-deployment

#!/usr/bin/env bash
set -euo pipefail

# GHCR에서 최신 이미지 받기 (사전 docker login ghcr.io 완료 상태)
docker compose pull app

# 무중단 교체: 새 컨테이너 기동 후 헬스체크 통과 시 전환
docker compose up -d --no-deps --wait app

# 오래된 이미지 정리
docker image prune -f