212 lines
8.4 KiB
YAML
212 lines
8.4 KiB
YAML
name: Deploy to Production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-prod-main
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
DEPLOY_HOST: 178.104.200.7
|
|
DEPLOY_USER: kjh2064
|
|
SERVICE_NAME: quantengine
|
|
DOTNET_VERSION: '10.0.x'
|
|
QUANTENGINE_DB_NAME: quantenginedb
|
|
QUANTENGINE_DB_USER: quantengine_app
|
|
TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-H1ZdV0"
|
|
TELEGRAM_CHAT_ID_DEFAULT: "-5460205872"
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
name: Build & Deploy to Production
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v3
|
|
with:
|
|
dotnet-version: ${{ env.DOTNET_VERSION }}
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v4
|
|
with:
|
|
python-version: '3.10'
|
|
|
|
- name: Install Python Dependencies
|
|
run: pip install pyyaml openpyxl requests
|
|
|
|
- name: "[GATE] Run Core Validations"
|
|
run: |
|
|
echo "🔐 Running critical CI validations..."
|
|
python3 tools/validate_no_direct_api_trading_v1.py || exit 1
|
|
python3 tools/validate_specs.py || exit 1
|
|
echo "✅ All critical validations passed"
|
|
|
|
- name: Ensure Temp Directory and Mock Packet
|
|
run: |
|
|
mkdir -p Temp
|
|
if [ ! -f Temp/final_decision_packet_active.json ]; then
|
|
echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json
|
|
fi
|
|
|
|
- name: Restore Dependencies
|
|
run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj
|
|
|
|
- name: Build Release
|
|
run: |
|
|
dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
|
|
-c Release \
|
|
--no-restore
|
|
|
|
- name: Run Unit Tests
|
|
run: |
|
|
dotnet test src/dotnet/QuantEngine.Core.Tests/QuantEngine.Core.Tests.csproj \
|
|
-c Release \
|
|
--no-build
|
|
|
|
- name: Publish Release Package
|
|
run: |
|
|
dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
|
|
-c Release \
|
|
--no-build \
|
|
-o ./publish
|
|
|
|
- name: Generate Build Info
|
|
run: |
|
|
COMMIT_HASH=$(git rev-parse --short HEAD)
|
|
BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
|
|
mkdir -p ./publish/wwwroot
|
|
printf '{\n "version": "1.0.%s-%s",\n "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
|
|
echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"
|
|
|
|
- name: Setup SSH
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
else
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
fi
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
- name: Prepare QuantEngine DB Env
|
|
run: |
|
|
mkdir -p ./deploy
|
|
cat > ./deploy/quantengine.env <<EOF
|
|
ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=${QUANTENGINE_DB_NAME};Username=${QUANTENGINE_DB_USER};Password=${{ secrets.QUANTENGINE_DB_PASSWORD }};Search Path=quantengine;
|
|
EOF
|
|
chmod 600 ./deploy/quantengine.env
|
|
|
|
- name: Package Artifact
|
|
run: |
|
|
tar -czf quantengine.tar.gz -C ./publish .
|
|
echo "✓ Package size: $(du -sh quantengine.tar.gz | cut -f1)"
|
|
|
|
- name: Deploy & Verify on Server
|
|
run: |
|
|
set -e
|
|
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
|
COMMIT=$(git rev-parse --short HEAD)
|
|
DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
|
|
DEPLOY_USER="${{ env.DEPLOY_USER }}"
|
|
|
|
TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
|
|
[ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
|
|
TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
|
|
[ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"
|
|
|
|
send_telegram() {
|
|
local text="$1"
|
|
curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
|
-d "chat_id=${TELEGRAM_CHAT_ID}" \
|
|
--data-urlencode "text=${text}" \
|
|
-d "parse_mode=HTML" >/dev/null || true
|
|
}
|
|
|
|
notify_failure() {
|
|
local exit_code=$?
|
|
send_telegram "❌ <b>QuantEngine 배포 실패</b>
|
|
|
|
커밋: <code>${COMMIT}</code>
|
|
시간: <code>${TIMESTAMP}</code>
|
|
단계: deploy-to-prod (SSH Execution)"
|
|
exit "$exit_code"
|
|
}
|
|
|
|
trap notify_failure ERR
|
|
|
|
echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ==="
|
|
|
|
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p /home/kjh2064/tmp"
|
|
scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
quantengine.tar.gz "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/quantengine.tar.gz"
|
|
scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
tools/deploy_quantengine.sh "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/deploy.sh"
|
|
scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
deploy/quantengine.env "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/quantengine.env"
|
|
|
|
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"
|
|
|
|
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"
|
|
|
|
echo "=== Verifying Loopback Health ==="
|
|
loopback_headers=$(ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_HOST" "curl -s -D - -o /dev/null http://127.0.0.1:5000/")
|
|
echo "$loopback_headers"
|
|
if ! printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.1 30[12] '; then
|
|
echo "Loopback health check failed for quantengine" >&2
|
|
exit 1
|
|
fi
|
|
if ! printf '%s' "$loopback_headers" | grep -qiE '^Location: /not-found'; then
|
|
echo "Loopback redirect target is unexpected" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Verifying Favicon Assets ==="
|
|
favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "http://${DEPLOY_HOST}/favicon.svg")
|
|
favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "http://${DEPLOY_HOST}/favicon.png")
|
|
echo "/favicon.svg -> ${favicon_svg_code}"
|
|
echo "/favicon.png -> ${favicon_png_code}"
|
|
if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ]; then
|
|
echo "Favicon assets are not reachable after deploy" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Verifying Public Routes ==="
|
|
root_headers=$(curl -s -D - -o /dev/null "http://${DEPLOY_HOST}/")
|
|
ops_headers=$(curl -s -D - -o /dev/null "http://${DEPLOY_HOST}/operations")
|
|
|
|
root_code=$(printf '%s' "$root_headers" | awk 'NR==1 {print $2}')
|
|
ops_code=$(printf '%s' "$ops_headers" | awk 'NR==1 {print $2}')
|
|
|
|
echo "/ -> ${root_code}"
|
|
echo "/operations -> ${ops_code}"
|
|
|
|
if [ "$root_code" != "302" ]; then
|
|
echo "Deployment content check failed for /" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$ops_code" != "302" ]; then
|
|
echo "Deployment content check failed for /operations" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
|
|
send_telegram "✅ <b>QuantEngine 배포 완료</b>
|
|
|
|
커밋: <code>${COMMIT}</code>
|
|
시간: <code>${TIMESTAMP}</code>
|
|
대상: <code>${DEPLOY_HOST}</code>"
|