name: Backend CI dev

# develop 브랜치 전용 CI. PR 검증, push 시 개발 이미지 릴리즈까지만 한다.
# 개발 서버 배포는 cd-dev.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - develop
  pull_request:
    branches:
      - develop

jobs:
  pr-ci:
    name: Backend CI dev pull_request
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # PR 게이트웨이 검사 유지
      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 컴파일 (테스트 코드 포함)
      - name: Run Compile
        run: ./gradlew compileJava compileTestJava

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

  pr-notify:
    name: Discord notification (dev PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "백엔드 Develop pull_request CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  push-ci:
    if: github.event_name == 'push'
    name: Backend CI dev release
    runs-on: ubuntu-latest
    concurrency:
      group: backend-develop-release
      cancel-in-progress: false

    permissions:
      contents: write
      id-token: write
      issues: write
      pull-requests: write

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # semantic-release가 Git 태그 및 히스토리를 분석해야 하므로 0 유지 필수
          fetch-depth: 0

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

      - name: Build jar
        run: ./gradlew bootJar

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # release.config.develop.json을 .releaserc.json으로 복사해서 쓴다 (main-ci와 동일한 이유).
      - name: Release backend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.develop.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  push-notify:
    name: Discord notification (dev release)
    runs-on: ubuntu-latest
    needs: push-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Backend Dev push CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend Dev CI: ${{ needs.push-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.push-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: Backend CI prod

# main 브랜치 전용 CI. PR 검증, push 시 프로덕션 이미지 릴리즈까지만 한다.
# 프로덕션 배포는 cd-prod.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  pr-ci:
    name: Backend CI prod pull_request
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # PR 게이트웨이 검사 유지
      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 컴파일 (테스트 코드 포함)
      - name: Run Compile
        run: ./gradlew compileJava compileTestJava

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

  pr-notify:
    name: Discord notification (prod PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "백엔드 Main pull_request CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  main-ci:
    if: github.event_name == 'push'
    name: Backend CI prod release
    runs-on: ubuntu-latest
    concurrency:
      group: backend-main-release
      cancel-in-progress: false

    permissions:
      contents: write      # Git 태그, Release 생성
      id-token: write      # GCP Workload Identity와 통신하기 위한 OIDC 토큰 발행 권한

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

      - name: Build jar
        run: ./gradlew bootJar

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # release.config.main.json을 이 job 안에서만 .releaserc.json으로 복사해서 쓴다.
      - name: Release backend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.main.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  main-notify:
    name: Discord notification (prod release)
    runs-on: ubuntu-latest
    needs: main-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Backend main CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend CI: ${{ needs.main-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.main-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: Chat CI dev

# develop 브랜치 전용 CI. PR 검증, push 시 개발 이미지 릴리즈까지만 한다.
# 개발 서버 배포는 cd-dev.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - develop
  pull_request:
    branches:
      - develop

jobs:
  pr-ci:
    name: Chat CI dev pull_request
    runs-on: ubuntu-latest
    # 테스트가 실제 MySQL을 쓴다 (@DataJpaTest는 DB 교체 안 함, @SpringBootTest는 Flyway 실행)
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_DATABASE: mulo_chat
          MYSQL_USER: chat
          MYSQL_PASSWORD: chat
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -u root -proot --silent"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # PR 게이트웨이 검사 유지
      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 컴파일 (테스트 코드 포함)
      - name: Run Compile
        run: ./gradlew compileJava compileTestJava

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        env:
          CHAT_DB_URL: jdbc:mysql://127.0.0.1:3306/mulo_chat
          CHAT_DB_USERNAME: chat
          CHAT_DB_PASSWORD: chat
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

  pr-notify:
    name: Discord notification (dev PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Chat Develop pull_request CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Chat CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  push-ci:
    if: github.event_name == 'push'
    name: Chat CI dev release
    runs-on: ubuntu-latest
    # 테스트가 실제 MySQL을 쓴다 (@DataJpaTest는 DB 교체 안 함, @SpringBootTest는 Flyway 실행)
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_DATABASE: mulo_chat
          MYSQL_USER: chat
          MYSQL_PASSWORD: chat
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -u root -proot --silent"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20    concurrency:
      group: backend-develop-release
      cancel-in-progress: false

    permissions:
      contents: write
      id-token: write
      issues: write
      pull-requests: write

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # semantic-release가 Git 태그 및 히스토리를 분석해야 하므로 0 유지 필수
          fetch-depth: 0

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        env:
          CHAT_DB_URL: jdbc:mysql://127.0.0.1:3306/mulo_chat
          CHAT_DB_USERNAME: chat
          CHAT_DB_PASSWORD: chat
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

      - name: Build jar
        run: ./gradlew bootJar

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # release.config.develop.json을 .releaserc.json으로 복사해서 쓴다 (main-ci와 동일한 이유).
      - name: Release backend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.develop.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  push-notify:
    name: Discord notification (dev release)
    runs-on: ubuntu-latest
    needs: push-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Chat Dev push CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Chat Dev CI: ${{ needs.push-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.push-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: Chat CI prod

# main 브랜치 전용 CI. PR 검증, push 시 프로덕션 이미지 릴리즈까지만 한다.
# 프로덕션 배포는 cd-prod.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  pr-ci:
    name: Chat CI prod pull_request
    runs-on: ubuntu-latest
    # 테스트가 실제 MySQL을 쓴다 (@DataJpaTest는 DB 교체 안 함, @SpringBootTest는 Flyway 실행)
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_DATABASE: mulo_chat
          MYSQL_USER: chat
          MYSQL_PASSWORD: chat
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -u root -proot --silent"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      # PR 게이트웨이 검사 유지
      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 컴파일 (테스트 코드 포함)
      - name: Run Compile
        run: ./gradlew compileJava compileTestJava

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        env:
          CHAT_DB_URL: jdbc:mysql://127.0.0.1:3306/mulo_chat
          CHAT_DB_USERNAME: chat
          CHAT_DB_PASSWORD: chat
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

  pr-notify:
    name: Discord notification (prod PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Chat Main pull_request CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Chat CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  main-ci:
    if: github.event_name == 'push'
    name: Chat CI prod release
    runs-on: ubuntu-latest
    # 테스트가 실제 MySQL을 쓴다 (@DataJpaTest는 DB 교체 안 함, @SpringBootTest는 Flyway 실행)
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_DATABASE: mulo_chat
          MYSQL_USER: chat
          MYSQL_PASSWORD: chat
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -u root -proot --silent"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20    concurrency:
      group: backend-main-release
      cancel-in-progress: false

    permissions:
      contents: write      # Git 태그, Release 생성
      id-token: write      # GCP Workload Identity와 통신하기 위한 OIDC 토큰 발행 권한

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission
        run: chmod +x gradlew

      - name: Run Checkstyle
        run: ./gradlew checkstyleMain

      # 테스트 실행 + 커버리지 검사 (60% 미만이면 여기서 실패)
      - name: Run Tests and Coverage Verification
        env:
          CHAT_DB_URL: jdbc:mysql://127.0.0.1:3306/mulo_chat
          CHAT_DB_USERNAME: chat
          CHAT_DB_PASSWORD: chat
        run: ./gradlew test jacocoTestReport jacocoTestCoverageVerification

      # 리포트는 실패했을 때도 확인할 수 있도록 항상 올린다
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: build/reports/jacoco/test/html
          retention-days: 7

      - name: Upload test report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/test
          retention-days: 7

      - name: Build jar
        run: ./gradlew bootJar

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # release.config.main.json을 이 job 안에서만 .releaserc.json으로 복사해서 쓴다.
      # `semantic-release --extends <path>`로 직접 넘기면 플러그인 모듈 해석 기준 경로가
      # 달라져서 semantic-release 코어에 번들된 기본 플러그인(commit-analyzer 등)조차
      # 못 찾는 문제가 있었다(2026-09-30 실제 발생, main-ci에서 재현 확인). cosmiconfig가
      # 원래 쓰던 자동 탐색 방식 그대로 두고, 파일만 이 job 시작 시점에 맞바꿔 충돌을 피한다.
      - name: Release backend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.main.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  main-notify:
    name: Discord notification (prod release)
    runs-on: ubuntu-latest
    needs: main-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Chat main CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Chat CI: ${{ needs.main-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.main-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: AI CI dev

# develop 브랜치 전용 CI. PR 검증, push 시 개발 이미지 릴리즈까지만 한다.
# 개발 서버 배포는 cd-dev.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - develop
  pull_request:
    branches:
      - develop

jobs:
  pr-ci:
    name: AI CI dev pull_request
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      # 1. 코드 체크아웃
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      # 2. Ruff 설치 + 린트 검사
      - name: Ruff 실행
        uses: astral-sh/ruff-action@v3
        with:
          args: "check"

      # 3. Ruff로 포맷 검사
      - name: Run Ruff Formatter Check
        run: ruff format --check .

      # 4. Python 환경 설정
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      # 5. 애플리케이션 의존성 설치
      - name: Install dependencies
        run: python -m pip install -r requirements-dev.txt

      # 6. 컴파일
      - name: Check Python syntax
        run: python -m compileall .

      # 7. 테스트 실행 중 커버리지 측정
      - name: Run tests with coverage
        run: coverage run -m pytest

      # 8. 커버리지 60% 미만이면 여기서 실패
      - name: Coverage verification
        run: |
          coverage report --fail-under=60
          coverage xml
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

  pr-notify:
    name: Discord notification (dev PR)
    runs-on: ubuntu-latest
    needs: pr-ci

    # CI가 실패해도 알림 작업 실행
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI develop CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  push-ci:
    if: github.event_name == 'push'
    concurrency:
      group: ai-develop-release
      cancel-in-progress: false
    name: AI CI dev release
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      # 1. 코드 체크아웃
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # semantic-release가 Git 태그 및 히스토리를 분석해야 하므로 0 유지 필수
          fetch-depth: 0

      # 2. Python 환경 설정
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      # 3. 애플리케이션 의존성 설치
      - name: Install dependencies
        run: python -m pip install -r requirements-dev.txt

      # 4. 컴파일
      - name: Check Python syntax
        run: python -m compileall .

      # 7. 테스트 실행 중 커버리지 측정
      - name: Run tests with coverage
        run: coverage run -m pytest

      # 8. 커버리지 60% 미만이면 여기서 실패
      - name: Coverage verification
        run: |
          coverage report --fail-under=60
          coverage xml
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

      # 5. Node.js 설정
      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      - name: Release ai image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.develop.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  push-notify:
    name: Discord notification (dev release)
    runs-on: ubuntu-latest
    needs: push-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI Dev push CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI Dev CI: ${{ needs.push-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.push-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: AI CI prod

# main 브랜치 전용 CI. PR 검증, push 시 프로덕션 이미지 릴리즈까지만 한다.
# 프로덕션 배포는 cd-prod.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  pr-ci:
    name: AI CI prod pull_request
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      # 1. 코드 체크아웃
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      # 2. Ruff 설치 + 린트 검사
      - name: Ruff 실행
        uses: astral-sh/ruff-action@v3
        with:
          args: "check"

      # 3. Ruff로 포맷 검사
      - name: Run Ruff Formatter Check
        run: ruff format --check .

      # 4. Python 환경 설정
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      # 5. 애플리케이션 의존성 설치
      - name: Install dependencies
        run: python -m pip install -r requirements-dev.txt

      # 6. 컴파일
      - name: Check Python syntax
        run: python -m compileall .

      # 7. 테스트 실행 중 커버리지 측정
      - name: Run tests with coverage
        run: coverage run -m pytest

      # 8. 커버리지 60% 미만이면 여기서 실패
      - name: Coverage verification
        run: |
          coverage report --fail-under=60
          coverage xml
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

  pr-notify:
    name: Discord notification (prod PR)
    runs-on: ubuntu-latest
    needs: pr-ci

    # CI가 실패해도 알림 작업 실행
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI main CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  main-ci:
    if: github.event_name == 'push'
    name: AI CI prod release
    runs-on: ubuntu-latest
    concurrency:
      group: ai-main-release
      cancel-in-progress: false

    # 워크플로우 권한 정의
    permissions:
      contents: write      # Git 태그, Release 생성
      id-token: write      # GCP Workload Identity와 통신하기 위한 OIDC 토큰 발행 권한

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      # 1. 코드 체크아웃
      - name: Checkout code
        uses: actions/checkout@v7
        with:
            fetch-depth: 0

      # 2. Ruff 설치 + 린트 검사
      - name: Ruff 실행
        uses: astral-sh/ruff-action@v3
        with:
            args: "check"

      # 3. Ruff로 포맷 검사
      - name: Run Ruff Formatter Check
        run: ruff format --check .

      # 4. Python 환경 설정
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      # 5. 애플리케이션 의존성 설치
      - name: Install dependencies
        run: python -m pip install -r requirements-dev.txt

      # 6. 컴파일
      - name: Check Python syntax
        run: python -m compileall .

      # 7. 테스트 실행 중 커버리지 측정
      - name: Run tests with coverage
        run: coverage run -m pytest

      # 8. 커버리지 60% 미만이면 여기서 실패
      - name: Coverage verification
        run: |
          coverage report --fail-under=60
          coverage xml
      - name: Upload coverage report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

      # Phase 1: semantic-release 실행 환경 구성
      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      # Phase 2: Docker Build 준비
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Phase 3: OIDC를 이용한 서비스 계정 인증
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      # Phase 4: gcloud 명령어 사용 준비
      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      # Phase 5: Docker가 GCP 인증 정보를 사용하도록 연결
      - name: Configure Docker authentication
        run: |
            gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # Phase 6: 버전 계산 -> image build, push -> Git 태그, Release 생성
      - name: Release AI image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.main.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  main-notify:
    name: Discord notification (prod release)
    runs-on: ubuntu-latest
    needs: main-ci

    # CI가 실패해도 알림 작업 실행
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI main CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI CI: ${{ needs.main-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.main-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: Frontend CI dev

# develop 브랜치 전용 CI. PR 검증, push 시 개발 이미지 릴리즈까지만 한다.
# 개발 서버 배포는 cd-dev.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - develop
  pull_request:
    branches:
      - develop

jobs:
  pr-ci:
    name: Frontend dev PR Check
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # PR 검증은 최신 커밋만 검사하므로 얕은 복사(shallow clone) 사용
          fetch-depth: 1

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      # Phase 1: 스타일 검사
      - name: Run Prettier
        run: npm run prettier

      # Phase 2: Lint 검사
      - name: Run ESLint
        run: npm run lint

      # Phase 3: TypeScript 타입 검사
      - name: Typecheck
        run: npm run typecheck

  pr-notify:
    name: Discord notification (dev PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend develop PR 검증 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend PR CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  push-ci:
    if: github.event_name == 'push'
    name: Frontend CI dev release
    runs-on: ubuntu-latest
    concurrency:
      group: frontend-develop-release
      cancel-in-progress: false

    permissions:
      contents: write   # Git 태그 및 GitHub Release 생성 권한
      id-token: write   # GCP Workload Identity OIDC 인증 권한
      issues: write
      pull-requests: write

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # semantic-release가 커밋 로그와 태그를 추적해야 하므로 전체 히스토리 필요
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      # Phase 1: 애플리케이션 빌드
      - name: Build
        run: npm run build

      # Phase 2: Docker Buildx 설정
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Phase 3: GCP 인증 (OIDC)
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      # Phase 4: gcloud CLI 준비
      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      # Phase 5: Artifact Registry Docker 인증
      - name: Configure Docker authentication
        run: |
          gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # release.config.develop.json을 .releaserc.json으로 복사해서 쓴다 (main-ci와 같은 방식).
      - name: Release frontend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
        run: |
          cp release.config.develop.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  push-notify:
    name: Discord notification (dev release)
    runs-on: ubuntu-latest
    needs: push-ci
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend Dev push CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend Dev CI: ${{ needs.push-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.push-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인]",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }},
                    "inline": true
                  }
                ]
              }
            ]

name: Frontend CI prod

# main 브랜치 전용 CI. PR 검증, push 시 프로덕션 이미지 릴리즈까지만 한다.
# 프로덕션 배포는 cd-prod.yml이 이 워크플로가 성공하면 이어서 한다.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  pr-ci:
    name: Frontend prod PR Check
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # PR 검증은 최신 커밋만 검사하므로 얕은 복사(shallow clone) 사용
          fetch-depth: 1

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      # Phase 1: 스타일 검사
      - name: Run Prettier
        run: npm run prettier

      # Phase 2: Lint 검사
      - name: Run ESLint
        run: npm run lint

      # Phase 3: TypeScript 타입 검사
      - name: Typecheck
        run: npm run typecheck

  pr-notify:
    name: Discord notification (prod PR)
    runs-on: ubuntu-latest
    needs: pr-ci
    if: ${{ always() }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend main PR 검증 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend PR CI: ${{ needs.pr-ci.result }}",
                "description": ${{ toJSON(github.event.pull_request.title) }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.pr-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "PR",
                    "value": "[#${{ github.event.pull_request.number }}](${{ github.event.pull_request.html_url }})",
                    "inline": true
                  },
                  {
                    "name": "작성자",
                    "value": ${{ toJSON(github.event.pull_request.user.login) }},
                    "inline": true
                  },
                  {
                    "name": "작업 브랜치",
                    "value": ${{ toJSON(github.head_ref) }},
                    "inline": true
                  },
                  {
                    "name": "대상 브랜치",
                    "value": ${{ toJSON(github.base_ref) }},
                    "inline": true
                  }
                ]
              }
            ]
  main-ci:
    if: github.event_name == 'push'
    name: Frontend CI prod release
    runs-on: ubuntu-latest
    concurrency:
      group: frontend-main-release
      cancel-in-progress: false

    # 워크플로우 권한 정의
    permissions:
      contents: write      # Git 태그, Release 생성
      id-token: write      # GCP Workload Identity와 통신하기 위한 OIDC 토큰 발행 권한

    env:
      IMAGE_BASE: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}

    steps:
      # 1. 코드 체크아웃
      - name: Checkout code
        uses: actions/checkout@v7
        with:
            fetch-depth: 0

      # 2. Node.js
      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"

      # 3. 의존성 설치
      - name: Install dependencies
        run: npm ci

      # Phase 1: Prettier
      - name: Run Prettier
        run: npm run prettier

      # Phase 2: Lint (ESlint)
      - name: Run ESlint
        run: npm run lint

      # Phase 3: TypeScript 타입 오류 검사
      - name: Typecheck
        run: npm run typecheck

      # Phase 4: Build
      - name: Build
        run: npm run build

      # Phase 5: Docker Build 준비
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Phase 6: OIDC를 이용한 서비스 계정 인증
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      # Phase 7: gcloud 명령어 사용 준비
      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      # Phase 8: Docker가 GCP 인증 정보를 사용하도록 연결
      - name: Configure Docker authentication
        run: |
            gcloud auth configure-docker "${{ secrets.GCP_REGION }}-docker.pkg.dev" --quiet
      # Phase 9: 버전 계산 -> image build, push -> Git 태그, Release 생성
      - name: Release frontend image
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
          # release.config.main.json의 prepareCmd(docker buildx build)가 이 값들을 참조
          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          cp release.config.main.json .releaserc.json
          npx --yes \
            --package=semantic-release@25 \
            --package=@semantic-release/exec@7 \
            semantic-release
  main-notify:
    name: Discord notification (prod release)
    runs-on: ubuntu-latest
    needs: main-ci

    # CI가 실패해도 알림 작업 실행
    if: ${{ always() && github.event_name == 'push' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CI result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend main CI 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend CI: ${{ needs.main-ci.result }}",
                "description": ${{ toJSON(github.event.head_commit.message || '커밋 메시지 없음') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.main-ci.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": ${{ toJSON(github.ref_name) }}
                  }
                ]
              }
            ]

name: Backend CD dev

# develop CI(ci-dev.yml)가 성공하면 자동으로 개발 서버에 배포한다.
# workflow_dispatch는 개발 서버에 다시 배포하고 싶을 때 수동으로 쓴다.
# 주의: workflow_run으로 실행되는 워크플로는 기본 브랜치(main)에 있는 파일 기준으로 실행된다.
on:
  workflow_run:
    workflows: ["Backend CI dev"]
    types: [completed]
    branches: [develop]
  workflow_dispatch:

env:
  ZONE: asia-northeast3-a
  DEV_VM_NAME: mulo-v2-dev-vm   # Terraform이 만든 개발 VM 이름

jobs:
  deploy:
    name: Deploy to Develop VM
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    concurrency:
      group: cd-backend-develop
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      vm: ${{ steps.develop.outputs.vm }}

    steps:
      # WIF로 GCP 서비스 계정 인증 (키 파일 없이 임시 토큰 발급)
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - uses: google-github-actions/setup-gcloud@v3

      # 1. DEV_VM_NAME 이름의 개발 VM을 찾는다.
      - id: develop
        run: |
          VM=$(gcloud compute instances list \
            --filter="name=${{ env.DEV_VM_NAME }}" \
            --zones="${{ env.ZONE }}" \
            --format="value(name)")
          if [ -z "$VM" ]; then
            echo "${{ env.DEV_VM_NAME }} VM을 찾을 수 없습니다."
            exit 1
          fi
          echo "vm=$VM" >> "$GITHUB_OUTPUT"

      # 2. CI(semantic-release)가 방금 push한 이미지 중 가장 최근 태그를 조회한다.
      #    CD는 이미지를 직접 빌드하지 않고, CI가 이미 push해둔 걸 그대로 가져다 쓴다.
      - id: image
        run: |
          TAG=$(gcloud artifacts docker images list \
            "${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}" \
            --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
            --format="value(TAGS)" | cut -d',' -f1)
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      # 3. backend.env 파일을 GitHub Secrets 값으로 생성한다.
      #    이 파일은 여기서만 잠깐 만들어지고, 실제 값은 워크플로 로그에 자동으로 마스킹된다.
      - run: |
          cat > backend.env <<ENVEOF
          DB_URL=${{ secrets.DB_URL_Develop }}
          DB_USERNAME=${{ secrets.DB_USERNAME_Develop }}
          DB_PASSWORD=${{ secrets.DB_PASSWORD_Develop }}
          JWT_SECRET=${{ secrets.JWT_SECRET }}
          GCS_BUCKET_NAME=${{ secrets.GCS_BUCKET_NAME_Develop }}
          GCS_PROJECT_ID=${{ secrets.GCP_PROJECT_ID_Develop }}
          KAKAO_REST_API_KEY=${{ secrets.KAKAO_REST_API_KEY }}
          KMA_SERVICE_KEY=${{ secrets.KMA_SERVICE_KEY }}
          SPOTIFY_CLIENT_ID=${{ secrets.SPOTIFY_CLIENT_ID }}
          SPOTIFY_CLIENT_SECRET=${{ secrets.SPOTIFY_CLIENT_SECRET }}
          AI_BASE_URL=${{ secrets.AI_BASE_URL }}
          AI_INTERNAL_TOKEN=${{ secrets.AI_INTERNAL_TOKEN }}
          MULO_SECURITY_ALLOWED_ORIGINS=${{ secrets.MULO_SECURITY_ALLOWED_ORIGINS_Develop }}
          REPORT_OPERATION_TOKEN=${{ secrets.REPORT_OPERATION_TOKEN }}
          # 컨테이너 JVM 기본 시간대가 UTC라, java.sql.Timestamp -> LocalDateTime 변환 시
          # (Timestamp가 상속하는 java.util.Date의 레거시 getter가 JVM 기본시간대를 씀)
          # DB에 정상 저장된 KST 값을 9시간 밀려서 읽는 문제가 있었다. JVM 기본시간대 자체를
          # 앱이 실제 쓰는 Asia/Seoul로 맞춰서 이 변환 단계의 시간대 불일치를 없앤다.
          JAVA_TOOL_OPTIONS=-Duser.timezone=Asia/Seoul
          ENVEOF

      # 4. env 파일을 develop VM으로 전송하고, 새 이미지를 pull해서 backend 컨테이너만 교체한다.
      #    같은 VM 위의 frontend/ai/nginx 컨테이너는 건드리지 않는다.
      - run: |
          gcloud compute scp backend.env "${{ steps.develop.outputs.vm }}:~/app/backend.env" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap

          gcloud compute ssh "${{ steps.develop.outputs.vm }}" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
              set -e
              sudo gcloud auth configure-docker '${{ secrets.GCP_REGION }}-docker.pkg.dev' --quiet
              cd ~/app
              export IMAGE_TAG=${{ steps.image.outputs.tag }}
              export GCP_PROJECT_ID=${{ secrets.GCP_PROJECT_ID_Develop }}
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose pull backend
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose up -d backend
            "

      # 5. 컨테이너가 healthy 상태가 될 때까지 대기 
      - name: "Wait for backend container to be healthy"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            for i in \$(seq 1 20); do
              status=\$(sudo docker inspect backend --format='{{.State.Health.Status}}')
              if [ \"\$status\" = \"healthy\" ]; then
                echo \"backend healthy (시도 \$i/20)\"
                exit 0
              fi
              echo \"대기 중... (\$i/20) 현재 상태: \$status\"
              sleep 3
            done
            echo \"backend가 60초 안에 healthy가 되지 않았습니다.\"
            exit 1
          "

      # nginx는 컨테이너 DNS를 시작/리로드 시점에만 캐싱하므로, 방금 재생성된
      # backend의 새 IP를 반영하도록 reload한다.
      - name: "Reload nginx to pick up new container IP"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            sudo docker exec nginx nginx -s reload
          "

  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: deploy
    if: ${{ always() && needs.deploy.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Backend Develop 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend Develop 배포: ${{ needs.deploy.result }}",
                "description": ${{ toJSON(github.event.workflow_run.head_commit.message || '수동 실행') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.deploy.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.event.workflow_run.head_sha || github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.event.workflow_run.actor.login || github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": "develop",
                    "inline": true
                  }
                ]
              }
            ]

name: Backend CD prod

# CI가 main에서 성공적으로 끝나면 자동으로 실행된다.
# workflow_dispatch는 특정 태그로 재배포하거나 이전 버전으로 되돌릴 때 수동으로 쓴다.
on:
  workflow_run:
    workflows: ["Backend CI prod"]
    types: [completed]
    branches: [main]
  workflow_dispatch:
    inputs:
      image_tag:
        description: "배포할 이미지 태그 (비우면 가장 최근 태그)"
        required: false
        type: string

env:
  SERVICE: backend
  MIG_NAME: muro-backend-mig
  MIG_FLAG: "--zone=asia-northeast3-a"
  MAX_SURGE: "1"
  MAX_UNAVAILABLE: "0"
  REPLACEMENT_METHOD: substitute

jobs:
  # ============================================================
  # 1단계: 배포할 이미지 태그와 현재 인스턴스 템플릿을 확인한다. (VM은 건드리지 않는다)
  # ============================================================
  prepare:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      image_tag: ${{ steps.image.outputs.tag }}
      prev_template: ${{ steps.current.outputs.template }}
      new_template: ${{ steps.name.outputs.template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 이미지는 CD가 빌드하지 않고, CI가 push해둔 것을 그대로 쓴다.
      # 수동 실행 때 태그를 넣으면 그 태그를, 비우면 가장 최근 태그를 쓴다.
      - id: image
        env:
          INPUT_TAG: ${{ inputs.image_tag }}
          IMAGE_REPO: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG=$(gcloud artifacts docker images list "$IMAGE_REPO" \
              --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
              --format="value(TAGS)" | cut -d',' -f1)
          fi
          if [ -z "$TAG" ]; then
            echo "배포할 이미지 태그를 찾을 수 없습니다."
            exit 1
          fi
          # 해당 태그의 이미지가 실제로 있는지 확인한다.
          gcloud artifacts docker images describe "$IMAGE_REPO:$TAG" > /dev/null
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
      # 롤백할 때 되돌아갈 현재 인스턴스 템플릿 이름
      - id: current
        run: |
          TEMPLATE=$(gcloud compute instance-groups managed describe "$MIG_NAME" $MIG_FLAG \
            --format="value(versions[0].instanceTemplate.basename())")
          if [ -z "$TEMPLATE" ]; then
            echo "$MIG_NAME 의 현재 인스턴스 템플릿을 찾을 수 없습니다."
            exit 1
          fi
          echo "template=$TEMPLATE" >> "$GITHUB_OUTPUT"
      # 새 템플릿 이름: 서비스-tpl-태그-실행번호 (소문자, 숫자, 하이픈만 가능)
      - id: name
        env:
          TAG: ${{ steps.image.outputs.tag }}
        run: |
          SAFE=$(echo "$TAG" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' '-' | sed 's/-*$//')
          echo "template=${SERVICE}-tpl-${SAFE}-${{ github.run_number }}" >> "$GITHUB_OUTPUT"
  # ============================================================
  # 2단계: 새 인스턴스 템플릿을 만들고 MIG를 교체한다.
  # environment: production 에 지정한 승인자가 승인해야 시작한다.
  # ============================================================
  rolling-update:
    needs: prepare
    runs-on: ubuntu-latest
    environment: production
    concurrency:
      group: cd-backend-production
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      TAG: ${{ needs.prepare.outputs.image_tag }}
      PREV_TEMPLATE: ${{ needs.prepare.outputs.prev_template }}
      NEW_TEMPLATE: ${{ needs.prepare.outputs.new_template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 현재 템플릿을 복사하고 이미지 태그 메타데이터만 바꾼 새 템플릿을 만든다.
      # VM은 부팅할 때 이 태그의 이미지를 받아서 실행한다.
      - name: Create instance template
        run: |
          gcloud compute instance-templates create "$NEW_TEMPLATE" \
            --source-instance-template="$PREV_TEMPLATE" \
            --metadata=app-image-tag="$TAG"
      - id: start
        name: Start rolling update
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$NEW_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
      # 모든 VM이 새 템플릿으로 교체되고 헬스체크를 통과할 때까지 기다린다.
      - name: Wait until all instances are updated
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      - name: Wait until the group is stable
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --stable --timeout=300
      # 교체 도중 실패하면 이전 템플릿으로 되돌린다. (교체를 시작한 경우에만)
      - name: Rollback to previous template
        if: ${{ failure() && steps.start.outcome == 'success' }}
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$PREV_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      # 오래된 템플릿은 최근 5개만 남기고 지운다. (사용 중인 템플릿은 삭제되지 않는다)
      - name: Delete old instance templates
        if: ${{ success() }}
        continue-on-error: true
        run: |
          gcloud compute instance-templates list \
            --filter="name~^${SERVICE}-tpl-" \
            --sort-by="~creationTimestamp" \
            --format="value(name)" \
            | tail -n +6 \
            | while read -r T; do
                gcloud compute instance-templates delete "$T" --quiet || true
              done
  # 배포 결과 알림
  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: [prepare, rolling-update]
    if: ${{ always() && needs.prepare.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Backend 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Backend 배포: ${{ needs.rolling-update.result }}",
                "description": "이미지 태그: ${{ needs.prepare.outputs.image_tag }}",
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.rolling-update.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "실행한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "배포 방식",
                    "value": "Rolling Update",
                    "inline": true
                  }
                ]
              }
            ]

name: Chat CD prod

# Chat Server는 사전에 안내한 점검 시간에만 배포한다.
# CI 성공으로 자동 실행하지 않고 수동 실행만 허용하며, 점검 안내를 했는지 확인을 받는다.
on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "배포할 이미지 태그 (비우면 가장 최근 태그)"
        required: false
        type: string
      maintenance_confirmed:
        description: "점검 시간을 사전에 안내했습니다"
        required: true
        type: boolean
        default: false

env:
  SERVICE: chat
  MIG_NAME: muro-chat-mig
  MIG_FLAG: "--zone=asia-northeast3-a"
  MAX_SURGE: "0"
  MAX_UNAVAILABLE: "1"
  REPLACEMENT_METHOD: recreate

jobs:
  # ============================================================
  # 1단계: 배포할 이미지 태그와 현재 인스턴스 템플릿을 확인한다. (VM은 건드리지 않는다)
  # ============================================================
  prepare:
    if: ${{ inputs.maintenance_confirmed == true }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      image_tag: ${{ steps.image.outputs.tag }}
      prev_template: ${{ steps.current.outputs.template }}
      new_template: ${{ steps.name.outputs.template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 이미지는 CD가 빌드하지 않고, CI가 push해둔 것을 그대로 쓴다.
      # 수동 실행 때 태그를 넣으면 그 태그를, 비우면 가장 최근 태그를 쓴다.
      - id: image
        env:
          INPUT_TAG: ${{ inputs.image_tag }}
          IMAGE_REPO: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG=$(gcloud artifacts docker images list "$IMAGE_REPO" \
              --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
              --format="value(TAGS)" | cut -d',' -f1)
          fi
          if [ -z "$TAG" ]; then
            echo "배포할 이미지 태그를 찾을 수 없습니다."
            exit 1
          fi
          # 해당 태그의 이미지가 실제로 있는지 확인한다.
          gcloud artifacts docker images describe "$IMAGE_REPO:$TAG" > /dev/null
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
      # 롤백할 때 되돌아갈 현재 인스턴스 템플릿 이름
      - id: current
        run: |
          TEMPLATE=$(gcloud compute instance-groups managed describe "$MIG_NAME" $MIG_FLAG \
            --format="value(versions[0].instanceTemplate.basename())")
          if [ -z "$TEMPLATE" ]; then
            echo "$MIG_NAME 의 현재 인스턴스 템플릿을 찾을 수 없습니다."
            exit 1
          fi
          echo "template=$TEMPLATE" >> "$GITHUB_OUTPUT"
      # 새 템플릿 이름: 서비스-tpl-태그-실행번호 (소문자, 숫자, 하이픈만 가능)
      - id: name
        env:
          TAG: ${{ steps.image.outputs.tag }}
        run: |
          SAFE=$(echo "$TAG" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' '-' | sed 's/-*$//')
          echo "template=${SERVICE}-tpl-${SAFE}-${{ github.run_number }}" >> "$GITHUB_OUTPUT"
  # ============================================================
  # 2단계: 새 인스턴스 템플릿을 만들고 MIG를 교체한다.
  # environment: production 에 지정한 승인자가 승인해야 시작한다.
  # ============================================================
  rolling-update:
    needs: prepare
    runs-on: ubuntu-latest
    environment: production
    concurrency:
      group: cd-chat-production
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      TAG: ${{ needs.prepare.outputs.image_tag }}
      PREV_TEMPLATE: ${{ needs.prepare.outputs.prev_template }}
      NEW_TEMPLATE: ${{ needs.prepare.outputs.new_template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 현재 템플릿을 복사하고 이미지 태그 메타데이터만 바꾼 새 템플릿을 만든다.
      # VM은 부팅할 때 이 태그의 이미지를 받아서 실행한다.
      - name: Create instance template
        run: |
          gcloud compute instance-templates create "$NEW_TEMPLATE" \
            --source-instance-template="$PREV_TEMPLATE" \
            --metadata=app-image-tag="$TAG"
      - id: start
        name: Start rolling update
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$NEW_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
      # 모든 VM이 새 템플릿으로 교체되고 헬스체크를 통과할 때까지 기다린다.
      - name: Wait until all instances are updated
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      - name: Wait until the group is stable
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --stable --timeout=300
      # 교체 도중 실패하면 이전 템플릿으로 되돌린다. (교체를 시작한 경우에만)
      - name: Rollback to previous template
        if: ${{ failure() && steps.start.outcome == 'success' }}
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$PREV_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      # 오래된 템플릿은 최근 5개만 남기고 지운다. (사용 중인 템플릿은 삭제되지 않는다)
      - name: Delete old instance templates
        if: ${{ success() }}
        continue-on-error: true
        run: |
          gcloud compute instance-templates list \
            --filter="name~^${SERVICE}-tpl-" \
            --sort-by="~creationTimestamp" \
            --format="value(name)" \
            | tail -n +6 \
            | while read -r T; do
                gcloud compute instance-templates delete "$T" --quiet || true
              done
  # 배포 결과 알림
  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: [prepare, rolling-update]
    if: ${{ always() && needs.prepare.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Chat 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Chat 배포: ${{ needs.rolling-update.result }}",
                "description": "이미지 태그: ${{ needs.prepare.outputs.image_tag }}",
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.rolling-update.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "실행한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "배포 방식",
                    "value": "Recreate (점검 시간)",
                    "inline": true
                  }
                ]
              }
            ]

name: AI CD dev

# develop CI(ci-dev.yml)가 성공하면 자동으로 개발 서버에 배포한다.
# workflow_dispatch는 개발 서버에 다시 배포하고 싶을 때 수동으로 쓴다.
# 주의: workflow_run으로 실행되는 워크플로는 기본 브랜치(main)에 있는 파일 기준으로 실행된다.
on:
  workflow_run:
    workflows: ["AI CI dev"]
    types: [completed]
    branches: [develop]
  workflow_dispatch:

env:
  ZONE: asia-northeast3-a
  DEV_VM_NAME: mulo-v2-dev-vm   # Terraform이 만든 개발 VM 이름

jobs:
  deploy:
    name: Deploy to Develop VM
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    concurrency:
      group: cd-ai-develop
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      vm: ${{ steps.develop.outputs.vm }}

    steps:
      # WIF로 GCP 서비스 계정 인증 (키 파일 없이 임시 토큰 발급)
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - uses: google-github-actions/setup-gcloud@v3

      # 1. DEV_VM_NAME 이름의 개발 VM을 찾는다.
      - id: develop
        run: |
          VM=$(gcloud compute instances list \
            --filter="name=${{ env.DEV_VM_NAME }}" \
            --zones="${{ env.ZONE }}" \
            --format="value(name)")
          if [ -z "$VM" ]; then
            echo "${{ env.DEV_VM_NAME }} VM을 찾을 수 없습니다."
            exit 1
          fi
          echo "vm=$VM" >> "$GITHUB_OUTPUT"

      # 2. CI(semantic-release)가 방금 push한 이미지 중 가장 최근 태그를 조회한다.
      - id: image
        run: |
          TAG=$(gcloud artifacts docker images list \
            "${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}" \
            --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
            --format="value(TAGS)" | cut -d',' -f1)
          if [ -z "$TAG" ]; then
            echo "조회된 Docker 이미지 태그가 없습니다."
            exit 1
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      # 3. ai.env 파일을 GitHub Secrets 값으로 생성한다.
      - run: |
          cat > ai.env <<ENVEOF
          APP_ENV=${{ secrets.APP_ENV || 'develop' }}
          INTERNAL_TOKEN=${{ secrets.AI_INTERNAL_TOKEN || secrets.INTERNAL_TOKEN }}
          DATABASE_URL=${{ secrets.DATABASE_URL_Develop || secrets.DATABASE_URL }}
          AI_CLIENT_MODE=${{ secrets.AI_CLIENT_MODE }}
          ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
          LLM_MODEL=${{ secrets.LLM_MODEL }}
          OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
          TEXT_EMBEDDING_MODEL=${{ secrets.TEXT_EMBEDDING_MODEL }}
          TEXT_EMBEDDING_DIM=${{ secrets.TEXT_EMBEDDING_DIM }}
          REPLICATE_API_TOKEN=${{ secrets.REPLICATE_API_TOKEN }}
          CLIP_MODEL=${{ secrets.CLIP_MODEL }}
          CLIP_EMBEDDING_DIM=${{ secrets.CLIP_EMBEDDING_DIM }}
          SPOTIFY_CLIENT_ID=${{ secrets.SPOTIFY_CLIENT_ID }}
          SPOTIFY_CLIENT_SECRET=${{ secrets.SPOTIFY_CLIENT_SECRET }}
          YOUTUBE_API_KEY=${{ secrets.YOUTUBE_API_KEY }}
          BACKEND_MYSQL_URL=${{ secrets.BACKEND_MYSQL_URL_Develop || secrets.BACKEND_MYSQL_URL }}
          BACKEND_INTERNAL_URL=${{ secrets.BACKEND_INTERNAL_URL_Develop || secrets.BACKEND_INTERNAL_URL }}
          RUN_WORKER=true
          ENVEOF

      # 4. env 파일을 develop VM으로 전송하고, 새 이미지를 pull해서 ai 컨테이너만 교체한다.
      #    같은 VM 위의 backend/frontend/nginx 컨테이너는 건드리지 않는다.
      - run: |
          gcloud compute scp ai.env "${{ steps.develop.outputs.vm }}:~/app/ai.env" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap

          gcloud compute ssh "${{ steps.develop.outputs.vm }}" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
              set -e
              sudo gcloud auth configure-docker '${{ secrets.GCP_REGION }}-docker.pkg.dev' --quiet
              cd ~/app
              export IMAGE_TAG=${{ steps.image.outputs.tag }}
              export GCP_PROJECT_ID=${{ secrets.GCP_PROJECT_ID_Develop }}
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose pull ai
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose up -d ai
            "

      # 5. 컨테이너가 healthy 상태가 될 때까지 대기
      - name: "Wait for ai container to be healthy"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            for i in \$(seq 1 20); do
              status=\$(sudo docker inspect ai --format='{{.State.Health.Status}}' 2>/dev/null || echo 'unhealthy')
              if [ \"\$status\" = \"healthy\" ]; then
                echo \"ai healthy (시도 \$i/20)\"
                exit 0
              fi
              echo \"대기 중... (\$i/20) 현재 상태: \$status\"
              sleep 3
            done
            echo \"ai가 60초 안에 healthy가 되지 않았습니다.\"
            exit 1
          "

      # nginx는 컨테이너 DNS를 시작/리로드 시점에만 캐싱하므로, 방금 재생성된
      # ai의 새 IP를 반영하도록 reload한다.
      - name: "Reload nginx to pick up new container IP"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            sudo docker exec nginx nginx -s reload
          "

  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: deploy
    if: ${{ always() && needs.deploy.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI Develop 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI Develop 배포: ${{ needs.deploy.result }}",
                "description": ${{ toJSON(github.event.workflow_run.head_commit.message || '수동 실행') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.deploy.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.event.workflow_run.head_sha || github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.event.workflow_run.actor.login || github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": "develop",
                    "inline": true
                  }
                ]
              }
            ]

name: AI CD prod

# CI가 main에서 성공적으로 끝나면 자동으로 실행된다.
# workflow_dispatch는 특정 태그로 재배포하거나 이전 버전으로 되돌릴 때 수동으로 쓴다.
on:
  workflow_run:
    workflows: ["AI CI prod"]
    types: [completed]
    branches: [main]
  workflow_dispatch:
    inputs:
      image_tag:
        description: "배포할 이미지 태그 (비우면 가장 최근 태그)"
        required: false
        type: string

env:
  SERVICE: ai
  MIG_NAME: muro-ai-mig
  MIG_FLAG: "--zone=asia-northeast3-a"
  MAX_SURGE: "1"
  MAX_UNAVAILABLE: "0"
  REPLACEMENT_METHOD: substitute

jobs:
  # ============================================================
  # 1단계: 배포할 이미지 태그와 현재 인스턴스 템플릿을 확인한다. (VM은 건드리지 않는다)
  # ============================================================
  prepare:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      image_tag: ${{ steps.image.outputs.tag }}
      prev_template: ${{ steps.current.outputs.template }}
      new_template: ${{ steps.name.outputs.template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 이미지는 CD가 빌드하지 않고, CI가 push해둔 것을 그대로 쓴다.
      # 수동 실행 때 태그를 넣으면 그 태그를, 비우면 가장 최근 태그를 쓴다.
      - id: image
        env:
          INPUT_TAG: ${{ inputs.image_tag }}
          IMAGE_REPO: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG=$(gcloud artifacts docker images list "$IMAGE_REPO" \
              --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
              --format="value(TAGS)" | cut -d',' -f1)
          fi
          if [ -z "$TAG" ]; then
            echo "배포할 이미지 태그를 찾을 수 없습니다."
            exit 1
          fi
          # 해당 태그의 이미지가 실제로 있는지 확인한다.
          gcloud artifacts docker images describe "$IMAGE_REPO:$TAG" > /dev/null
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
      # 롤백할 때 되돌아갈 현재 인스턴스 템플릿 이름
      - id: current
        run: |
          TEMPLATE=$(gcloud compute instance-groups managed describe "$MIG_NAME" $MIG_FLAG \
            --format="value(versions[0].instanceTemplate.basename())")
          if [ -z "$TEMPLATE" ]; then
            echo "$MIG_NAME 의 현재 인스턴스 템플릿을 찾을 수 없습니다."
            exit 1
          fi
          echo "template=$TEMPLATE" >> "$GITHUB_OUTPUT"
      # 새 템플릿 이름: 서비스-tpl-태그-실행번호 (소문자, 숫자, 하이픈만 가능)
      - id: name
        env:
          TAG: ${{ steps.image.outputs.tag }}
        run: |
          SAFE=$(echo "$TAG" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' '-' | sed 's/-*$//')
          echo "template=${SERVICE}-tpl-${SAFE}-${{ github.run_number }}" >> "$GITHUB_OUTPUT"
  # ============================================================
  # 2단계: 새 인스턴스 템플릿을 만들고 MIG를 교체한다.
  # environment: production 에 지정한 승인자가 승인해야 시작한다.
  # ============================================================
  rolling-update:
    needs: prepare
    runs-on: ubuntu-latest
    environment: production
    concurrency:
      group: cd-ai-production
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      TAG: ${{ needs.prepare.outputs.image_tag }}
      PREV_TEMPLATE: ${{ needs.prepare.outputs.prev_template }}
      NEW_TEMPLATE: ${{ needs.prepare.outputs.new_template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 현재 템플릿을 복사하고 이미지 태그 메타데이터만 바꾼 새 템플릿을 만든다.
      # VM은 부팅할 때 이 태그의 이미지를 받아서 실행한다.
      - name: Create instance template
        run: |
          gcloud compute instance-templates create "$NEW_TEMPLATE" \
            --source-instance-template="$PREV_TEMPLATE" \
            --metadata=app-image-tag="$TAG"
      - id: start
        name: Start rolling update
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$NEW_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
      # 모든 VM이 새 템플릿으로 교체되고 헬스체크를 통과할 때까지 기다린다.
      - name: Wait until all instances are updated
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      - name: Wait until the group is stable
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --stable --timeout=300
      # 교체 도중 실패하면 이전 템플릿으로 되돌린다. (교체를 시작한 경우에만)
      - name: Rollback to previous template
        if: ${{ failure() && steps.start.outcome == 'success' }}
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$PREV_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      # 오래된 템플릿은 최근 5개만 남기고 지운다. (사용 중인 템플릿은 삭제되지 않는다)
      - name: Delete old instance templates
        if: ${{ success() }}
        continue-on-error: true
        run: |
          gcloud compute instance-templates list \
            --filter="name~^${SERVICE}-tpl-" \
            --sort-by="~creationTimestamp" \
            --format="value(name)" \
            | tail -n +6 \
            | while read -r T; do
                gcloud compute instance-templates delete "$T" --quiet || true
              done
  # 배포 결과 알림
  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: [prepare, rolling-update]
    if: ${{ always() && needs.prepare.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "AI 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "AI 배포: ${{ needs.rolling-update.result }}",
                "description": "이미지 태그: ${{ needs.prepare.outputs.image_tag }}",
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.rolling-update.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "실행한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "배포 방식",
                    "value": "Rolling Update",
                    "inline": true
                  }
                ]
              }
            ]

name: Frontend CD dev

# develop CI(ci-dev.yml)가 성공하면 자동으로 개발 서버에 배포한다.
# workflow_dispatch는 개발 서버에 다시 배포하고 싶을 때 수동으로 쓴다.
# 주의: workflow_run으로 실행되는 워크플로는 기본 브랜치(main)에 있는 파일 기준으로 실행된다.
on:
  workflow_run:
    workflows: ["Frontend CI dev"]
    types: [completed]
    branches: [develop]
  workflow_dispatch:

env:
  ZONE: asia-northeast3-a
  DEV_VM_NAME: mulo-v2-dev-vm   # Terraform이 만든 개발 VM 이름

jobs:
  deploy:
    name: Deploy to Develop VM
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    concurrency:
      group: cd-frontend-develop
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      vm: ${{ steps.develop.outputs.vm }}

    steps:
      # WIF로 GCP 서비스 계정 인증 (키 파일 없이 임시 토큰 발급)
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID_Develop }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_Develop }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_Develop }}

      - uses: google-github-actions/setup-gcloud@v3

      # 1. DEV_VM_NAME 이름의 개발 VM을 찾는다.
      - id: develop
        run: |
          VM=$(gcloud compute instances list \
            --filter="name=${{ env.DEV_VM_NAME }}" \
            --zones="${{ env.ZONE }}" \
            --format="value(name)")
          if [ -z "$VM" ]; then
            echo "${{ env.DEV_VM_NAME }} VM을 찾을 수 없습니다."
            exit 1
          fi
          echo "vm=$VM" >> "$GITHUB_OUTPUT"

      # 2. CI(semantic-release)가 방금 push한 이미지 중 가장 최근 태그를 조회한다.
      - id: image
        run: |
          TAG=$(gcloud artifacts docker images list \
            "${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID_Develop }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}" \
            --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
            --format="value(TAGS)" | cut -d',' -f1)
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      # 3. 빈 env 파일 생성
      - run: touch frontend.env

      # 4. env 파일을 develop VM으로 전송하고, 새 이미지를 pull해서 frontend 컨테이너만 교체한다.
      #    같은 VM 위의 backend/ai/nginx 컨테이너는 건드리지 않는다.
      - run: |
          gcloud compute scp frontend.env "${{ steps.develop.outputs.vm }}:~/app/frontend.env" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap

          gcloud compute ssh "${{ steps.develop.outputs.vm }}" \
            --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
              set -e
              sudo gcloud auth configure-docker '${{ secrets.GCP_REGION }}-docker.pkg.dev' --quiet
              cd ~/app
              export IMAGE_TAG=${{ steps.image.outputs.tag }}
              export GCP_PROJECT_ID=${{ secrets.GCP_PROJECT_ID_Develop }}
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose pull frontend
              sudo --preserve-env=IMAGE_TAG,GCP_PROJECT_ID docker compose up -d frontend
            "

      # 5. 컨테이너가 healthy 상태가 될 때까지 대기
      - name: "Wait for frontend container to be healthy"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            for i in \$(seq 1 20); do
              status=\$(sudo docker inspect frontend --format='{{.State.Health.Status}}' 2>/dev/null || echo 'unhealthy')
              if [ \"\$status\" = \"healthy\" ]; then
                echo \"frontend healthy (시도 \$i/20)\"
                exit 0
              fi
              echo \"대기 중... (\$i/20) 현재 상태: \$status\"
              sleep 3
            done
            echo \"frontend가 60초 안에 healthy가 되지 않았습니다.\"
            exit 1
          "

      # 6. nginx는 컨테이너 DNS를 시작/리로드 시점에만 캐싱하므로, 방금 재생성된
      #    frontend의 새 IP를 반영하도록 reload한다. 
      - name: "Reload nginx to pick up new container IP"
        run: |
          gcloud compute ssh "${{ steps.develop.outputs.vm }}" --zone="${{ env.ZONE }}" --tunnel-through-iap --command="
            sudo docker exec nginx nginx -s reload
          "

  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: deploy
    if: ${{ always() && needs.deploy.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend Develop 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend Develop 배포: ${{ needs.deploy.result }}",
                "description": ${{ toJSON(github.event.workflow_run.head_commit.message || '수동 실행') }},
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.deploy.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "커밋",
                    "value": "[커밋 확인](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.event.workflow_run.head_sha || github.sha }})",
                    "inline": true
                  },
                  {
                    "name": "푸시한 사람",
                    "value": ${{ toJSON(github.event.workflow_run.actor.login || github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "브랜치",
                    "value": "develop",
                    "inline": true
                  }
                ]
              }
            ]

name: Frontend CD prod

# CI가 main에서 성공적으로 끝나면 자동으로 실행된다.
# workflow_dispatch는 특정 태그로 재배포하거나 이전 버전으로 되돌릴 때 수동으로 쓴다.
on:
  workflow_run:
    workflows: ["Frontend CI prod"]
    types: [completed]
    branches: [main]
  workflow_dispatch:
    inputs:
      image_tag:
        description: "배포할 이미지 태그 (비우면 가장 최근 태그)"
        required: false
        type: string

env:
  SERVICE: frontend
  MIG_NAME: muro-frontend-mig
  MIG_FLAG: "--zone=asia-northeast3-a"
  MAX_SURGE: "1"
  MAX_UNAVAILABLE: "0"
  REPLACEMENT_METHOD: substitute

jobs:
  # ============================================================
  # 1단계: 배포할 이미지 태그와 현재 인스턴스 템플릿을 확인한다. (VM은 건드리지 않는다)
  # ============================================================
  prepare:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # GCP WIF 인증용 OIDC 토큰 발급 권한
    outputs:
      image_tag: ${{ steps.image.outputs.tag }}
      prev_template: ${{ steps.current.outputs.template }}
      new_template: ${{ steps.name.outputs.template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 이미지는 CD가 빌드하지 않고, CI가 push해둔 것을 그대로 쓴다.
      # 수동 실행 때 태그를 넣으면 그 태그를, 비우면 가장 최근 태그를 쓴다.
      - id: image
        env:
          INPUT_TAG: ${{ inputs.image_tag }}
          IMAGE_REPO: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.PROJECT_REPOSITORY }}/${{ secrets.IMAGE_NAME }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG=$(gcloud artifacts docker images list "$IMAGE_REPO" \
              --include-tags --sort-by="~UPDATE_TIME" --limit=1 \
              --format="value(TAGS)" | cut -d',' -f1)
          fi
          if [ -z "$TAG" ]; then
            echo "배포할 이미지 태그를 찾을 수 없습니다."
            exit 1
          fi
          # 해당 태그의 이미지가 실제로 있는지 확인한다.
          gcloud artifacts docker images describe "$IMAGE_REPO:$TAG" > /dev/null
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
      # 롤백할 때 되돌아갈 현재 인스턴스 템플릿 이름
      - id: current
        run: |
          TEMPLATE=$(gcloud compute instance-groups managed describe "$MIG_NAME" $MIG_FLAG \
            --format="value(versions[0].instanceTemplate.basename())")
          if [ -z "$TEMPLATE" ]; then
            echo "$MIG_NAME 의 현재 인스턴스 템플릿을 찾을 수 없습니다."
            exit 1
          fi
          echo "template=$TEMPLATE" >> "$GITHUB_OUTPUT"
      # 새 템플릿 이름: 서비스-tpl-태그-실행번호 (소문자, 숫자, 하이픈만 가능)
      - id: name
        env:
          TAG: ${{ steps.image.outputs.tag }}
        run: |
          SAFE=$(echo "$TAG" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' '-' | sed 's/-*$//')
          echo "template=${SERVICE}-tpl-${SAFE}-${{ github.run_number }}" >> "$GITHUB_OUTPUT"
  # ============================================================
  # 2단계: 새 인스턴스 템플릿을 만들고 MIG를 교체한다.
  # environment: production 에 지정한 승인자가 승인해야 시작한다.
  # ============================================================
  rolling-update:
    needs: prepare
    runs-on: ubuntu-latest
    environment: production
    concurrency:
      group: cd-frontend-production
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      TAG: ${{ needs.prepare.outputs.image_tag }}
      PREV_TEMPLATE: ${{ needs.prepare.outputs.prev_template }}
      NEW_TEMPLATE: ${{ needs.prepare.outputs.new_template }}
    steps:
      - id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      # 현재 템플릿을 복사하고 이미지 태그 메타데이터만 바꾼 새 템플릿을 만든다.
      # VM은 부팅할 때 이 태그의 이미지를 받아서 실행한다.
      - name: Create instance template
        run: |
          gcloud compute instance-templates create "$NEW_TEMPLATE" \
            --source-instance-template="$PREV_TEMPLATE" \
            --metadata=app-image-tag="$TAG"
      - id: start
        name: Start rolling update
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$NEW_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
      # 모든 VM이 새 템플릿으로 교체되고 헬스체크를 통과할 때까지 기다린다.
      - name: Wait until all instances are updated
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      - name: Wait until the group is stable
        run: |
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --stable --timeout=300
      # 교체 도중 실패하면 이전 템플릿으로 되돌린다. (교체를 시작한 경우에만)
      - name: Rollback to previous template
        if: ${{ failure() && steps.start.outcome == 'success' }}
        run: |
          gcloud compute instance-groups managed rolling-action start-update "$MIG_NAME" $MIG_FLAG \
            --version=template="$PREV_TEMPLATE" \
            --type=proactive \
            --minimal-action=replace \
            --most-disruptive-allowed-action=replace \
            --replacement-method="$REPLACEMENT_METHOD" \
            --max-surge="$MAX_SURGE" \
            --max-unavailable="$MAX_UNAVAILABLE"
          gcloud compute instance-groups managed wait-until "$MIG_NAME" $MIG_FLAG \
            --version-target-reached --timeout=900
      # 오래된 템플릿은 최근 5개만 남기고 지운다. (사용 중인 템플릿은 삭제되지 않는다)
      - name: Delete old instance templates
        if: ${{ success() }}
        continue-on-error: true
        run: |
          gcloud compute instance-templates list \
            --filter="name~^${SERVICE}-tpl-" \
            --sort-by="~creationTimestamp" \
            --format="value(name)" \
            | tail -n +6 \
            | while read -r T; do
                gcloud compute instance-templates delete "$T" --quiet || true
              done
  # 배포 결과 알림
  notify:
    name: Discord notification
    runs-on: ubuntu-latest
    needs: [prepare, rolling-update]
    if: ${{ always() && needs.prepare.result != 'skipped' }}
    permissions: {}

    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

    steps:
      - name: Send CD result to Discord
        if: ${{ env.DISCORD_WEBHOOK != '' }}
        uses: Ilshidur/[email protected]
        with:
          args: "Frontend 배포 결과 알림"
        env:
          DISCORD_USERNAME: MURO_BOT
          DISCORD_EMBEDS: |
            [
              {
                "title": "Frontend 배포: ${{ needs.rolling-update.result }}",
                "description": "이미지 태그: ${{ needs.prepare.outputs.image_tag }}",
                "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                "color": ${{ needs.rolling-update.result == 'success' && 3066993 || 15158332 }},
                "fields": [
                  {
                    "name": "실행한 사람",
                    "value": ${{ toJSON(github.actor) }},
                    "inline": true
                  },
                  {
                    "name": "배포 방식",
                    "value": "Rolling Update",
                    "inline": true
                  }
                ]
              }
            ]