chore(rebar): Pier_T_rebar 작업 폴더 초기 구성 및 외부 의존 파일 통합
- Code\rebar_pipeline, review_pipeline, pier-program을 정션에서 실제 폴더로 전환 - Code\rhino_mcp 및 CLAUDE_rhino배경.md 추가, .mcp.json은 PYTHONPATH로 새 위치 사용 - pier-program 내부 .git 제거(이력은 backup\pier-program_20261028.bundle에 보관) - worktree 가이드 반영(CLAUDE.local.md, HANDOFF.md) - D:\Rhino-MCP 경로 참조를 새 위치로 치환 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
ahnyongjooandClaude Sonnet 5.5 committed
commit
964a841de1
3978 files changed
+58013356
No files matched your search
@@ -0,0 +1,174 @@
|
||||
# GitHub Actions — Enterprise Level Deploy
|
||||
# Auto-generated by hmcmkit /pdca deploy
|
||||
# EKS + ArgoCD + Canary (Argo Rollouts) + Security Scan
|
||||
|
||||
name: Enterprise Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, develop, 'release/**']
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
AWS_REGION: ap-northeast-2
|
||||
ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.ap-northeast-2.amazonaws.com
|
||||
IMAGE_NAME: ${{ github.event.repository.name }}
|
||||
ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
|
||||
SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
|
||||
SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
|
||||
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
||||
|
||||
jobs:
|
||||
test-and-lint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- run: npm run lint
|
||||
- run: npm test -- --coverage
|
||||
- name: Coverage gate (80%+)
|
||||
run: |
|
||||
COVERAGE=$(npx nyc report --reporter=text-summary | grep 'Statements' | awk '{print $3}' | tr -d '%')
|
||||
if (( $(echo "$COVERAGE < 80" | bc -l) )); then
|
||||
echo "Coverage $COVERAGE% is below 80% threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
security-scan:
|
||||
runs-on: ubuntu-latest
|
||||
needs: test-and-lint
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: SAST — Semgrep
|
||||
uses: returntocorp/semgrep-action@v1
|
||||
with:
|
||||
config: 'p/owasp-top-ten'
|
||||
- name: Container Scan — Trivy
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1'
|
||||
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [test-and-lint, security-scan]
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
|
||||
aws-region: ${{ env.AWS_REGION }}
|
||||
- uses: aws-actions/amazon-ecr-login@v2
|
||||
- uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: |
|
||||
${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
|
||||
${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
||||
- name: Sentry Release — Create release & upload sourcemaps
|
||||
uses: getsentry/action-release@v1
|
||||
env:
|
||||
SENTRY_AUTH_TOKEN: ${{ env.SENTRY_AUTH_TOKEN }}
|
||||
SENTRY_ORG: ${{ env.SENTRY_ORG }}
|
||||
SENTRY_PROJECT: ${{ env.SENTRY_PROJECT }}
|
||||
with:
|
||||
environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
|
||||
version: ${{ github.sha }}
|
||||
sourcemaps: './apps/web/.next'
|
||||
set_commits: auto
|
||||
|
||||
deploy-dev:
|
||||
if: github.ref == 'refs/heads/develop'
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-and-push
|
||||
environment: development
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Deploy to DEV (Docker Compose on EC2)
|
||||
run: |
|
||||
echo "Deploying to DEV via Docker Compose"
|
||||
# ssh deploy@dev-server "cd /app && docker compose pull && docker compose up -d"
|
||||
|
||||
deploy-staging:
|
||||
if: startsWith(github.ref, 'refs/heads/release/')
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-and-push
|
||||
environment: staging
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Update Helm values for staging
|
||||
run: |
|
||||
sed -i "s|image.tag:.*|image.tag: ${{ github.sha }}|" infra/k8s/overlays/staging/values.yaml
|
||||
- name: Commit and push (ArgoCD auto-sync)
|
||||
run: |
|
||||
git config user.name "hmcmkit-deploy"
|
||||
git config user.email "deploy@hmcmkit.dev"
|
||||
git add infra/
|
||||
git commit -m "chore(deploy): update staging image to ${{ github.sha }}"
|
||||
git push
|
||||
|
||||
deploy-prod:
|
||||
if: github.ref == 'refs/heads/main'
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-and-push
|
||||
environment:
|
||||
name: production
|
||||
url: https://app.example.com
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Update Helm values for production (Canary)
|
||||
run: |
|
||||
sed -i "s|image.tag:.*|image.tag: ${{ github.sha }}|" infra/k8s/overlays/prod/values.yaml
|
||||
- name: Commit and push (ArgoCD + Argo Rollouts canary)
|
||||
run: |
|
||||
git config user.name "hmcmkit-deploy"
|
||||
git config user.email "deploy@hmcmkit.dev"
|
||||
git add infra/
|
||||
git commit -m "chore(deploy): canary prod image to ${{ github.sha }}"
|
||||
git push
|
||||
|
||||
post-deploy-monitoring:
|
||||
if: github.ref == 'refs/heads/main'
|
||||
runs-on: ubuntu-latest
|
||||
needs: deploy-prod
|
||||
steps:
|
||||
- name: Wait for canary stabilization
|
||||
run: sleep 300 # 5min — canary 10% traffic period
|
||||
|
||||
- name: Verify Sentry — no new critical issues
|
||||
run: |
|
||||
ISSUES=$(curl -s -H "Authorization: Bearer ${{ env.SENTRY_AUTH_TOKEN }}" \
|
||||
"https://sentry.io/api/0/projects/${{ env.SENTRY_ORG }}/${{ env.SENTRY_PROJECT }}/issues/?query=is:unresolved+release:${{ github.sha }}&statsPeriod=5m" \
|
||||
| jq 'length')
|
||||
echo "New unresolved issues: $ISSUES"
|
||||
if [ "$ISSUES" -gt "5" ]; then
|
||||
echo "::error::Too many new issues ($ISSUES) — triggering rollback"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Verify Prometheus — error rate check
|
||||
run: |
|
||||
ERROR_RATE=$(curl -s "http://${{ secrets.PROMETHEUS_URL }}/api/v1/query?query=rate(http_requests_total{status=~\"5..\"}[5m])/rate(http_requests_total[5m])" \
|
||||
| jq '.data.result[0].value[1]' -r 2>/dev/null || echo "0")
|
||||
echo "Current error rate: $ERROR_RATE"
|
||||
if (( $(echo "$ERROR_RATE > 0.01" | bc -l) )); then
|
||||
echo "::error::Error rate $ERROR_RATE exceeds 1% threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: On failure — trigger auto-rollback
|
||||
if: failure()
|
||||
run: |
|
||||
echo "::warning::Post-deploy checks failed — triggering Argo Rollouts abort"
|
||||
curl -X PUT "${{ env.ARGOCD_SERVER }}/api/v1/applications/${{ env.IMAGE_NAME }}/rollback" \
|
||||
-H "Authorization: Bearer ${{ secrets.ARGOCD_TOKEN }}"
|
||||
Reference in new issue
Block a user