QuantEngineByItz/.gitea/workflows/deploy-prod.yml

name: Deploy to Production

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: deploy-prod-main
  cancel-in-progress: true

env:
  DEPLOY_HOST: quant.taxbaik.com          # 앱 도메인 (헬스체크, URL 검증용)
  DEPLOY_SSH_HOST: 178.104.200.7          # SSH 직접 접속 IP (Cloudflare 우회)
  DEPLOY_USER: kjh2064
  SERVICE_NAME: quantengine
  DOTNET_VERSION: '10.0.x'
  QUANTENGINE_DB_NAME: quantenginedb
  QUANTENGINE_DB_USER: quantengine_app
  TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-H1ZdV0"
  TELEGRAM_CHAT_ID_DEFAULT: "-5460205872"

jobs:
  build-and-deploy:
    name: Build & Deploy to Production
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Setup .NET
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      - name: Install Python Dependencies
        run: pip install pyyaml openpyxl requests

      - name: "[GATE] Run Core Validations"
        run: |
          echo "🔐 Running critical CI validations..."
          python3 tools/validate_no_direct_api_trading_v1.py || exit 1
          python3 tools/validate_specs.py || exit 1
          echo "✅ All critical validations passed"

      - name: Ensure Temp Directory and Mock Packet
        run: |
          mkdir -p Temp
          if [ ! -f Temp/final_decision_packet_active.json ]; then
            echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json
          fi

      - name: Restore Dependencies
        run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj

      - name: Build Release
        run: |
          dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
            -c Release \
            --no-restore

      - name: Run Unit Tests
        run: |
          dotnet test src/dotnet/QuantEngine.Core.Tests/QuantEngine.Core.Tests.csproj \
            -c Release \
            --no-build

      - name: Publish Release Package
        run: |
          dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
            -c Release \
            --no-build \
            -o ./publish

      - name: Generate Build Info
        run: |
          COMMIT_HASH=$(git rev-parse --short HEAD)
          BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
          mkdir -p ./publish/wwwroot
          printf '{\n  "version": "1.0.%s-%s",\n  "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
          echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"

      - name: Setup SSH
        run: |
          echo "🔑 Setting up SSH configuration..."
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          # SSH 키 설정
          if [ -z "${{ secrets.SSH_PRIVATE_KEY }}" ]; then
            echo "❌ SSH_PRIVATE_KEY secret not configured"
            exit 1
          fi

          if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
            echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          else
            echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 2>/dev/null || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          fi

          chmod 600 ~/.ssh/id_ed25519

          # SSH 키 검증
          if ! ssh-keygen -l -f ~/.ssh/id_ed25519 >/dev/null 2>&1; then
            echo "❌ SSH key validation failed"
            exit 1
          fi

          # 호스트 키 스캔 (재시도) - SSH 직접 IP 사용 (Cloudflare 우회)
          for i in 1 2 3; do
            if ssh-keyscan -t ed25519,rsa -H ${{ env.DEPLOY_SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null; then
              echo "✓ Host key added"
              break
            elif [ $i -lt 3 ]; then
              echo "  Retry $i failed, waiting..."
              sleep 2
            else
              echo "⚠️ Host key scan failed (continuing anyway)"
            fi
          done

          # SSH 연결 테스트 - SSH 직접 IP 사용
          echo "Testing SSH connection to ${{ env.DEPLOY_SSH_HOST }}..."
          if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
            "${{ env.DEPLOY_USER }}@${{ env.DEPLOY_SSH_HOST }}" "echo ✓ SSH OK"; then
            echo "✓ SSH connection verified"
          else
            echo "❌ SSH connection test failed"
            exit 1
          fi

      - name: Prepare & Validate QuantEngine DB Env
        run: |
          echo "🔧 Preparing database environment..."

          # QUANTENGINE_DB_PASSWORD: 미설정 시 빈 문자열로 처리
          DB_PASSWORD="${{ secrets.QUANTENGINE_DB_PASSWORD }}"
          if [ -z "$DB_PASSWORD" ]; then
            echo "⚠️  QUANTENGINE_DB_PASSWORD not set — using empty password"
          fi

          if [ -z "${{ env.QUANTENGINE_DB_NAME }}" ] || [ -z "${{ env.QUANTENGINE_DB_USER }}" ]; then
            echo "❌ DB configuration environment variables not set"
            exit 1
          fi

          # 1) 환경 파일 생성 (.env)
          mkdir -p ./deploy
          printf 'ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=%s;Username=%s;Password=%s;Search Path=quantengine;\n' \
            "${{ env.QUANTENGINE_DB_NAME }}" \
            "${{ env.QUANTENGINE_DB_USER }}" \
            "$DB_PASSWORD" > ./deploy/quantengine.env
          chmod 600 ./deploy/quantengine.env

          # 2) appsettings.Production.json 파일 동적 생성 및 배포 배포 폴더(publish) 반영
          mkdir -p ./publish
          cat <<EOF > ./publish/appsettings.Production.json
          {
            "ConnectionStrings": {
              "DefaultConnection": "Host=127.0.0.1;Database=${{ env.QUANTENGINE_DB_NAME }};Username=${{ env.QUANTENGINE_DB_USER }};Password=${DB_PASSWORD};Search Path=quantengine;"
            }
          }
          EOF
          chmod 600 ./publish/appsettings.Production.json

          # 파일 검증
          if [ ! -f ./deploy/quantengine.env ] || [ ! -f ./publish/appsettings.Production.json ]; then
            echo "❌ Failed to create database config files"
            exit 1
          fi

          echo "✓ Database configuration prepared (env and appsettings.Production.json)"

      - name: Package Artifact
        run: |
          echo "📦 Creating deployment package..."

          # 패키지 생성
          if ! tar -czf quantengine.tar.gz -C ./publish .; then
            echo "❌ Failed to create package"
            exit 1
          fi

          # 패키지 검증
          PACKAGE_SIZE=$(du -sh quantengine.tar.gz | cut -f1)
          PACKAGE_BYTES=$(stat -f%z quantengine.tar.gz 2>/dev/null || stat -c%s quantengine.tar.gz 2>/dev/null)

          if [ -z "$PACKAGE_BYTES" ] || [ "$PACKAGE_BYTES" -lt 1000000 ]; then
            echo "⚠️  Warning: Package seems too small ($PACKAGE_SIZE)"
          fi

          if [ ! -f quantengine.tar.gz ]; then
            echo "❌ Package file not created"
            exit 1
          fi

          echo "✓ Package created: $PACKAGE_SIZE"
          # SIGPIPE 에러 방지를 위해 tar 리스트 출력을 안전하게 처리
          tar -tzf quantengine.tar.gz | head -n 5 || true

      - name: Deploy & Verify on Server
        run: |
          set -e
          TIMESTAMP=$(date +%Y%m%d_%H%M%S)
          COMMIT=$(git rev-parse --short HEAD)
          DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
          DEPLOY_SSH_HOST="${{ env.DEPLOY_SSH_HOST }}"
          DEPLOY_USER="${{ env.DEPLOY_USER }}"

          TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
          [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
          TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
          [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"

          send_telegram() {
            local text="$1"
            curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
              -d "chat_id=${TELEGRAM_CHAT_ID}" \
              --data-urlencode "text=${text}" \
              -d "parse_mode=HTML" >/dev/null || true
          }

          notify_failure() {
            local exit_code=$?
            local error_msg="$1"
            send_telegram "❌ <b>QuantEngine 배포 실패</b>

            커밋: <code>${COMMIT}</code>
            시간: <code>${TIMESTAMP}</code>
            단계: ${error_msg:-deploy-to-prod}
            로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}"
            exit "$exit_code"
          }

          trap 'notify_failure "SSH/File Transfer"' ERR

          echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ==="

          # 원격 디렉토리 생성 - SSH 직접 IP 사용
          echo "📁 Creating remote directories..."
          if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
            "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/tmp"; then
            echo "❌ Failed to create remote directories"
            notify_failure "Remote directory creation"
          fi

          # 배포 파일 전송 (재시도)
          for file in quantengine.tar.gz:quantengine.tar.gz tools/deploy_quantengine.sh:deploy.sh deploy/quantengine.env:quantengine.env; do
            IFS=':' read -r SRC DST <<< "$file"
            echo "📤 Transferring $SRC..."

            for attempt in 1 2 3; do
              if scp -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
                "$SRC" "$DEPLOY_USER@$DEPLOY_SSH_HOST:/home/kjh2064/tmp/$DST" 2>&1; then
                echo "✓ Transferred $SRC"
                break
              elif [ $attempt -lt 3 ]; then
                echo "  Retry $attempt failed, waiting 5s..."
                sleep 5
              else
                echo "❌ Failed to transfer $SRC after 3 attempts"
                notify_failure "File transfer ($SRC)"
              fi
            done
          done

          # 배포 스크립트 실행 (재시도) - SSH 직접 IP 사용
          echo "🚀 Running deployment script..."
          for attempt in 1 2; do
            if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
              "$DEPLOY_USER@$DEPLOY_SSH_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"; then
              echo "✓ Deployment script executed successfully"
              break
            elif [ $attempt -lt 2 ]; then
              echo "⚠️  First attempt failed, retrying..."
              sleep 10
            else
              echo "❌ Deployment script failed after 2 attempts"
              notify_failure "Deployment script execution"
            fi
          done

          # 환경 파일 설치 - SSH 직접 IP 사용
          echo "⚙️ Installing environment configuration..."
          if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
            "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"; then
            echo "❌ Failed to install configuration"
            notify_failure "Configuration installation"
          fi

          # 서비스 안정화 대기
          echo "⏳ Waiting for service stabilization (15s)..."
          sleep 15

          echo "=== Verifying Loopback Health ==="
          loopback_headers=""
          health_check_passed=0

          for i in 1 2 3; do
            echo "  Health check attempt $i..."
            loopback_headers=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" "curl -s -D - -o /dev/null -m 5 http://127.0.0.1:5000/" 2>&1)

            if printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] (200|30[12]|401) '; then
              echo "✓ Loopback health check passed (auth required)"
              health_check_passed=1
              break
            elif [ $i -lt 3 ]; then
              echo "  Waiting 5s for service..."
              sleep 5
            fi
          done

          if [ $health_check_passed -eq 0 ]; then
            echo "❌ Loopback health check failed after 3 attempts"
            echo "Response: $loopback_headers"

            # 자동 롤백: 이전 버전으로 복구
            echo "🔄 Attempting automatic rollback..."
            PREV_DEPLOY=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
              "$DEPLOY_USER@$DEPLOY_SSH_HOST" \
              "ls -dt /home/kjh2064/deployments/quantengine_* 2>/dev/null | head -2 | tail -1")

            if [ -n "$PREV_DEPLOY" ]; then
              echo "Rolling back to: $PREV_DEPLOY"
              ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
                "$DEPLOY_USER@$DEPLOY_SSH_HOST" \
                "ln -sfn ${PREV_DEPLOY} /home/kjh2064/quantengine_active && sudo systemctl restart quantengine"

              echo "✓ Rollback completed"
              notify_failure "Health check (loopback) — Auto-rollback executed"
            else
              echo "⚠️ No previous deployment found for rollback"
              notify_failure "Health check (loopback) — No previous version available"
            fi
            exit 1
          fi

          if ! printf '%s' "$loopback_headers" | grep -qiE '(^Location: /login|^HTTP/1\.[01] 200 )'; then
            echo "⚠️ Unexpected redirect, but service is responding"
          fi

          echo "=== Verifying Database Connectivity ==="
          db_status=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" \
            "psql -U quantengine_app -d quantenginedb -h 127.0.0.1 -c 'SELECT 1;' 2>&1 | head -1" || echo "ERROR")

          if echo "$db_status" | grep -q "1"; then
            echo "✓ Database connectivity verified"
          elif echo "$db_status" | grep -q "password authentication failed"; then
            echo "⚠️ Database password authentication failed (may be resolved on next deploy)"
          else
            echo "❌ Database connectivity check failed: $db_status"
            notify_failure "Database connectivity"
            exit 1
          fi

          echo "=== Verifying Static Assets ==="
          favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.svg")
          favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.png")
          echo "/favicon.svg -> ${favicon_svg_code}"
          echo "/favicon.png -> ${favicon_png_code}"
          if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ] && [ "$favicon_svg_code" != "302" ] && [ "$favicon_png_code" != "302" ]; then
            echo "⚠️ Static assets may not be reachable (SVG:$favicon_svg_code, PNG:$favicon_png_code)"
          fi

          echo "=== Verifying Public Routes ==="
          public_root_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/")
          # /login is redirected (302) by the auth middleware to /Account/Login.
          # Check /Account/Login directly — it must return 200 (Razor page).
          login_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/Account/Login")

          public_root_code=$(printf '%s' "$public_root_headers" | awk 'NR==1 {print $2}')
          login_code=$(printf '%s' "$login_headers" | awk 'NR==1 {print $2}')

          echo "https://quant.taxbaik.com/ -> ${public_root_code}"
          echo "https://quant.taxbaik.com/Account/Login -> ${login_code}"

          if [ "$public_root_code" != "302" ] && [ "$public_root_code" != "200" ] && [ "$public_root_code" != "401" ]; then
            echo "Deployment content check failed for public root (received $public_root_code)" >&2
            exit 1
          fi
          if [ "$login_code" != "200" ] && [ "$login_code" != "302" ]; then
            echo "Deployment content check failed for login page (received $login_code, expected 200 or 302)" >&2
            exit 1
          fi

          echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
          send_telegram "✅ <b>QuantEngine 배포 완료</b>

          커밋: <code>${COMMIT}</code>
          시간: <code>${TIMESTAMP}</code>
          대상: <code>${DEPLOY_HOST}</code>"