name: Deploy to Production on: push: branches: - main workflow_dispatch: concurrency: group: deploy-prod-main cancel-in-progress: true env: DEPLOY_HOST: quant.taxbaik.com # 앱 도메인 (헬스체크, URL 검증용) DEPLOY_SSH_HOST: 178.104.200.7 # SSH 직접 접속 IP (Cloudflare 우회) DEPLOY_USER: kjh2064 SERVICE_NAME: quantengine DOTNET_VERSION: '10.0.x' QUANTENGINE_DB_NAME: quantenginedb QUANTENGINE_DB_USER: quantengine_app TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-H1ZdV0" TELEGRAM_CHAT_ID_DEFAULT: "-5460205872" jobs: build-and-deploy: name: Build & Deploy to Production runs-on: ubuntu-latest timeout-minutes: 15 steps: - name: Checkout Code uses: actions/checkout@v3 - name: Setup .NET uses: actions/setup-dotnet@v3 with: dotnet-version: ${{ env.DOTNET_VERSION }} - name: Setup Python uses: actions/setup-python@v4 with: python-version: '3.10' - name: Install Python Dependencies run: pip install pyyaml openpyxl requests - name: "[GATE] Run Core Validations" run: | echo "🔐 Running critical CI validations..." python3 tools/validate_no_direct_api_trading_v1.py || exit 1 python3 tools/validate_specs.py || exit 1 echo "✅ All critical validations passed" - name: Ensure Temp Directory and Mock Packet run: | mkdir -p Temp if [ ! -f Temp/final_decision_packet_active.json ]; then echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json fi - name: Restore Dependencies run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj - name: Build Release run: | dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \ -c Release \ --no-restore - name: Run Unit Tests run: | dotnet test src/dotnet/QuantEngine.Core.Tests/QuantEngine.Core.Tests.csproj \ -c Release \ --no-build - name: Publish Release Package run: | dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \ -c Release \ --no-build \ -o ./publish - name: Generate Build Info run: | COMMIT_HASH=$(git rev-parse --short HEAD) BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST') mkdir -p ./publish/wwwroot printf '{\n "version": "1.0.%s-%s",\n "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME" - name: Setup SSH run: | echo "🔑 Setting up SSH configuration..." mkdir -p ~/.ssh chmod 700 ~/.ssh # SSH 키 설정 if [ -z "${{ secrets.SSH_PRIVATE_KEY }}" ]; then echo "❌ SSH_PRIVATE_KEY secret not configured" exit 1 fi if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519 else echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 2>/dev/null || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519 fi chmod 600 ~/.ssh/id_ed25519 # SSH 키 검증 if ! ssh-keygen -l -f ~/.ssh/id_ed25519 >/dev/null 2>&1; then echo "❌ SSH key validation failed" exit 1 fi # 호스트 키 스캔 (재시도) - SSH 직접 IP 사용 (Cloudflare 우회) for i in 1 2 3; do if ssh-keyscan -t ed25519,rsa -H ${{ env.DEPLOY_SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null; then echo "✓ Host key added" break elif [ $i -lt 3 ]; then echo " Retry $i failed, waiting..." sleep 2 else echo "⚠️ Host key scan failed (continuing anyway)" fi done # SSH 연결 테스트 - SSH 직접 IP 사용 echo "Testing SSH connection to ${{ env.DEPLOY_SSH_HOST }}..." if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ "${{ env.DEPLOY_USER }}@${{ env.DEPLOY_SSH_HOST }}" "echo ✓ SSH OK"; then echo "✓ SSH connection verified" else echo "❌ SSH connection test failed" exit 1 fi - name: Prepare & Validate QuantEngine DB Env run: | echo "🔧 Preparing database environment..." # QUANTENGINE_DB_PASSWORD: 미설정 시 빈 문자열로 처리 (pg_hba.conf trust 모드 대응) DB_PASSWORD="${{ secrets.QUANTENGINE_DB_PASSWORD }}" if [ -z "$DB_PASSWORD" ]; then echo "⚠️ QUANTENGINE_DB_PASSWORD not set — using empty password (trust auth mode)" fi if [ -z "${{ env.QUANTENGINE_DB_NAME }}" ] || [ -z "${{ env.QUANTENGINE_DB_USER }}" ]; then echo "❌ DB configuration environment variables not set" exit 1 fi # 환경 파일 생성 mkdir -p ./deploy printf 'ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=%s;Username=%s;Password=%s;Search Path=quantengine;\n' \ "${{ env.QUANTENGINE_DB_NAME }}" \ "${{ env.QUANTENGINE_DB_USER }}" \ "$DB_PASSWORD" > ./deploy/quantengine.env chmod 600 ./deploy/quantengine.env # 파일 검증 if [ ! -f ./deploy/quantengine.env ]; then echo "❌ Failed to create database config file" exit 1 fi echo "✓ Database configuration prepared" - name: Package Artifact run: | echo "📦 Creating deployment package..." # 패키지 생성 if ! tar -czf quantengine.tar.gz -C ./publish .; then echo "❌ Failed to create package" exit 1 fi # 패키지 검증 PACKAGE_SIZE=$(du -sh quantengine.tar.gz | cut -f1) PACKAGE_BYTES=$(stat -f%z quantengine.tar.gz 2>/dev/null || stat -c%s quantengine.tar.gz 2>/dev/null) if [ -z "$PACKAGE_BYTES" ] || [ "$PACKAGE_BYTES" -lt 1000000 ]; then echo "⚠️ Warning: Package seems too small ($PACKAGE_SIZE)" fi if [ ! -f quantengine.tar.gz ]; then echo "❌ Package file not created" exit 1 fi echo "✓ Package created: $PACKAGE_SIZE" # SIGPIPE 에러 방지를 위해 tar 리스트 출력을 안전하게 처리 tar -tzf quantengine.tar.gz | head -n 5 || true - name: Deploy & Verify on Server run: | set -e TIMESTAMP=$(date +%Y%m%d_%H%M%S) COMMIT=$(git rev-parse --short HEAD) DEPLOY_HOST="${{ env.DEPLOY_HOST }}" DEPLOY_SSH_HOST="${{ env.DEPLOY_SSH_HOST }}" DEPLOY_USER="${{ env.DEPLOY_USER }}" TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}" [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}" TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}" [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}" send_telegram() { local text="$1" curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -d "chat_id=${TELEGRAM_CHAT_ID}" \ --data-urlencode "text=${text}" \ -d "parse_mode=HTML" >/dev/null || true } notify_failure() { local exit_code=$? local error_msg="$1" send_telegram "❌ QuantEngine 배포 실패 커밋: ${COMMIT} 시간: ${TIMESTAMP} 단계: ${error_msg:-deploy-to-prod} 로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}" exit "$exit_code" } trap 'notify_failure "SSH/File Transfer"' ERR echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ===" # 원격 디렉토리 생성 - SSH 직접 IP 사용 echo "📁 Creating remote directories..." if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/tmp"; then echo "❌ Failed to create remote directories" notify_failure "Remote directory creation" fi # 배포 파일 전송 (재시도) for file in quantengine.tar.gz:quantengine.tar.gz tools/deploy_quantengine.sh:deploy.sh deploy/quantengine.env:quantengine.env; do IFS=':' read -r SRC DST <<< "$file" echo "📤 Transferring $SRC..." for attempt in 1 2 3; do if scp -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ "$SRC" "$DEPLOY_USER@$DEPLOY_SSH_HOST:/home/kjh2064/tmp/$DST" 2>&1; then echo "✓ Transferred $SRC" break elif [ $attempt -lt 3 ]; then echo " Retry $attempt failed, waiting 5s..." sleep 5 else echo "❌ Failed to transfer $SRC after 3 attempts" notify_failure "File transfer ($SRC)" fi done done # 배포 스크립트 실행 (재시도) - SSH 직접 IP 사용 echo "🚀 Running deployment script..." for attempt in 1 2; do if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ "$DEPLOY_USER@$DEPLOY_SSH_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"; then echo "✓ Deployment script executed successfully" break elif [ $attempt -lt 2 ]; then echo "⚠️ First attempt failed, retrying..." sleep 10 else echo "❌ Deployment script failed after 2 attempts" notify_failure "Deployment script execution" fi done # 환경 파일 설치 - SSH 직접 IP 사용 echo "⚙️ Installing environment configuration..." if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"; then echo "❌ Failed to install configuration" notify_failure "Configuration installation" fi # 서비스 안정화 대기 echo "⏳ Waiting for service stabilization (15s)..." sleep 15 echo "=== Verifying Loopback Health ===" loopback_headers="" for i in 1 2 3; do echo " Health check attempt $i..." loopback_headers=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" "curl -s -D - -o /dev/null -m 5 http://127.0.0.1:5000/" 2>&1) if printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] (200|30[12]|401) '; then echo "✓ Loopback health check passed (auth required)" break elif [ $i -lt 3 ]; then echo " Waiting 5s for service..." sleep 5 fi done if ! printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] '; then echo "❌ Loopback health check failed" echo "Response: $loopback_headers" notify_failure "Health check (loopback)" fi if ! printf '%s' "$loopback_headers" | grep -qiE '(^Location: /login|^HTTP/1\.[01] 200 )'; then echo "⚠️ Unexpected redirect, but service is responding" fi echo "=== Verifying Favicon Assets ===" favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.svg") favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.png") echo "/favicon.svg -> ${favicon_svg_code}" echo "/favicon.png -> ${favicon_png_code}" if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ]; then echo "Favicon assets are not reachable after deploy" >&2 exit 1 fi echo "=== Verifying Public Routes ===" public_root_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/") login_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/login") public_root_code=$(printf '%s' "$public_root_headers" | awk 'NR==1 {print $2}') login_code=$(printf '%s' "$login_headers" | awk 'NR==1 {print $2}') echo "https://quant.taxbaik.com/ -> ${public_root_code}" echo "https://quant.taxbaik.com/login -> ${login_code}" if [ "$public_root_code" != "302" ] && [ "$public_root_code" != "200" ] && [ "$public_root_code" != "401" ]; then echo "Deployment content check failed for public root (received $public_root_code)" >&2 exit 1 fi if [ "$login_code" != "200" ]; then echo "Deployment content check failed for login page" >&2 exit 1 fi echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST" send_telegram "✅ QuantEngine 배포 완료 커밋: ${COMMIT} 시간: ${TIMESTAMP} 대상: ${DEPLOY_HOST}"