363 lines
14 KiB
YAML
363 lines
14 KiB
YAML
name: Deploy to Production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-prod-main
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
DEPLOY_HOST: quant.taxbaik.com # 앱 도메인 (헬스체크, URL 검증용)
|
|
DEPLOY_SSH_HOST: 178.104.200.7 # SSH 직접 접속 IP (Cloudflare 우회)
|
|
DEPLOY_USER: kjh2064
|
|
SERVICE_NAME: quantengine
|
|
DOTNET_VERSION: '10.0.x'
|
|
QUANTENGINE_DB_NAME: quantenginedb
|
|
QUANTENGINE_DB_USER: quantengine_app
|
|
TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-H1ZdV0"
|
|
TELEGRAM_CHAT_ID_DEFAULT: "-5460205872"
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
name: Build & Deploy to Production
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v3
|
|
with:
|
|
dotnet-version: ${{ env.DOTNET_VERSION }}
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v4
|
|
with:
|
|
python-version: '3.10'
|
|
|
|
- name: Install Python Dependencies
|
|
run: pip install pyyaml openpyxl requests
|
|
|
|
- name: "[GATE] Run Core Validations"
|
|
run: |
|
|
echo "🔐 Running critical CI validations..."
|
|
python3 tools/validate_no_direct_api_trading_v1.py || exit 1
|
|
python3 tools/validate_specs.py || exit 1
|
|
echo "✅ All critical validations passed"
|
|
|
|
- name: Ensure Temp Directory and Mock Packet
|
|
run: |
|
|
mkdir -p Temp
|
|
if [ ! -f Temp/final_decision_packet_active.json ]; then
|
|
echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json
|
|
fi
|
|
|
|
- name: Restore Dependencies
|
|
run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj
|
|
|
|
- name: Build Release
|
|
run: |
|
|
dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
|
|
-c Release \
|
|
--no-restore
|
|
|
|
- name: Run Unit Tests
|
|
run: |
|
|
dotnet test src/dotnet/QuantEngine.Core.Tests/QuantEngine.Core.Tests.csproj \
|
|
-c Release \
|
|
--no-build
|
|
|
|
- name: Publish Release Package
|
|
run: |
|
|
dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
|
|
-c Release \
|
|
--no-build \
|
|
-o ./publish
|
|
|
|
- name: Generate Build Info
|
|
run: |
|
|
COMMIT_HASH=$(git rev-parse --short HEAD)
|
|
BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
|
|
mkdir -p ./publish/wwwroot
|
|
printf '{\n "version": "1.0.%s-%s",\n "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
|
|
echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"
|
|
|
|
- name: Setup SSH
|
|
run: |
|
|
echo "🔑 Setting up SSH configuration..."
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# SSH 키 설정
|
|
if [ -z "${{ secrets.SSH_PRIVATE_KEY }}" ]; then
|
|
echo "❌ SSH_PRIVATE_KEY secret not configured"
|
|
exit 1
|
|
fi
|
|
|
|
if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
else
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 2>/dev/null || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
fi
|
|
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
# SSH 키 검증
|
|
if ! ssh-keygen -l -f ~/.ssh/id_ed25519 >/dev/null 2>&1; then
|
|
echo "❌ SSH key validation failed"
|
|
exit 1
|
|
fi
|
|
|
|
# 호스트 키 스캔 (재시도) - SSH 직접 IP 사용 (Cloudflare 우회)
|
|
for i in 1 2 3; do
|
|
if ssh-keyscan -t ed25519,rsa -H ${{ env.DEPLOY_SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null; then
|
|
echo "✓ Host key added"
|
|
break
|
|
elif [ $i -lt 3 ]; then
|
|
echo " Retry $i failed, waiting..."
|
|
sleep 2
|
|
else
|
|
echo "⚠️ Host key scan failed (continuing anyway)"
|
|
fi
|
|
done
|
|
|
|
# SSH 연결 테스트 - SSH 직접 IP 사용
|
|
echo "Testing SSH connection to ${{ env.DEPLOY_SSH_HOST }}..."
|
|
if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
|
|
"${{ env.DEPLOY_USER }}@${{ env.DEPLOY_SSH_HOST }}" "echo ✓ SSH OK"; then
|
|
echo "✓ SSH connection verified"
|
|
else
|
|
echo "❌ SSH connection test failed"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Prepare & Validate QuantEngine DB Env
|
|
run: |
|
|
echo "🔧 Preparing database environment..."
|
|
|
|
# QUANTENGINE_DB_PASSWORD: 미설정 시 빈 문자열로 처리
|
|
DB_PASSWORD="${{ secrets.QUANTENGINE_DB_PASSWORD }}"
|
|
if [ -z "$DB_PASSWORD" ]; then
|
|
echo "⚠️ QUANTENGINE_DB_PASSWORD not set — using empty password"
|
|
fi
|
|
|
|
if [ -z "${{ env.QUANTENGINE_DB_NAME }}" ] || [ -z "${{ env.QUANTENGINE_DB_USER }}" ]; then
|
|
echo "❌ DB configuration environment variables not set"
|
|
exit 1
|
|
fi
|
|
|
|
# 1) 환경 파일 생성 (.env)
|
|
mkdir -p ./deploy
|
|
printf 'ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=%s;Username=%s;Password=%s;Search Path=quantengine;\n' \
|
|
"${{ env.QUANTENGINE_DB_NAME }}" \
|
|
"${{ env.QUANTENGINE_DB_USER }}" \
|
|
"$DB_PASSWORD" > ./deploy/quantengine.env
|
|
chmod 600 ./deploy/quantengine.env
|
|
|
|
# 2) appsettings.Production.json 파일 동적 생성 및 배포 배포 폴더(publish) 반영
|
|
mkdir -p ./publish
|
|
cat <<EOF > ./publish/appsettings.Production.json
|
|
{
|
|
"ConnectionStrings": {
|
|
"DefaultConnection": "Host=127.0.0.1;Database=${{ env.QUANTENGINE_DB_NAME }};Username=${{ env.QUANTENGINE_DB_USER }};Password=${DB_PASSWORD};Search Path=quantengine;"
|
|
}
|
|
}
|
|
EOF
|
|
chmod 600 ./publish/appsettings.Production.json
|
|
|
|
# 파일 검증
|
|
if [ ! -f ./deploy/quantengine.env ] || [ ! -f ./publish/appsettings.Production.json ]; then
|
|
echo "❌ Failed to create database config files"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ Database configuration prepared (env and appsettings.Production.json)"
|
|
|
|
- name: Package Artifact
|
|
run: |
|
|
echo "📦 Creating deployment package..."
|
|
|
|
# 패키지 생성
|
|
if ! tar -czf quantengine.tar.gz -C ./publish .; then
|
|
echo "❌ Failed to create package"
|
|
exit 1
|
|
fi
|
|
|
|
# 패키지 검증
|
|
PACKAGE_SIZE=$(du -sh quantengine.tar.gz | cut -f1)
|
|
PACKAGE_BYTES=$(stat -f%z quantengine.tar.gz 2>/dev/null || stat -c%s quantengine.tar.gz 2>/dev/null)
|
|
|
|
if [ -z "$PACKAGE_BYTES" ] || [ "$PACKAGE_BYTES" -lt 1000000 ]; then
|
|
echo "⚠️ Warning: Package seems too small ($PACKAGE_SIZE)"
|
|
fi
|
|
|
|
if [ ! -f quantengine.tar.gz ]; then
|
|
echo "❌ Package file not created"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ Package created: $PACKAGE_SIZE"
|
|
# SIGPIPE 에러 방지를 위해 tar 리스트 출력을 안전하게 처리
|
|
tar -tzf quantengine.tar.gz | head -n 5 || true
|
|
|
|
- name: Deploy & Verify on Server
|
|
run: |
|
|
set -e
|
|
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
|
COMMIT=$(git rev-parse --short HEAD)
|
|
DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
|
|
DEPLOY_SSH_HOST="${{ env.DEPLOY_SSH_HOST }}"
|
|
DEPLOY_USER="${{ env.DEPLOY_USER }}"
|
|
|
|
TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
|
|
[ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
|
|
TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
|
|
[ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"
|
|
|
|
send_telegram() {
|
|
local text="$1"
|
|
curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
|
-d "chat_id=${TELEGRAM_CHAT_ID}" \
|
|
--data-urlencode "text=${text}" \
|
|
-d "parse_mode=HTML" >/dev/null || true
|
|
}
|
|
|
|
notify_failure() {
|
|
local exit_code=$?
|
|
local error_msg="$1"
|
|
send_telegram "❌ <b>QuantEngine 배포 실패</b>
|
|
|
|
커밋: <code>${COMMIT}</code>
|
|
시간: <code>${TIMESTAMP}</code>
|
|
단계: ${error_msg:-deploy-to-prod}
|
|
로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}"
|
|
exit "$exit_code"
|
|
}
|
|
|
|
trap 'notify_failure "SSH/File Transfer"' ERR
|
|
|
|
echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ==="
|
|
|
|
# 원격 디렉토리 생성 - SSH 직접 IP 사용
|
|
echo "📁 Creating remote directories..."
|
|
if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/tmp"; then
|
|
echo "❌ Failed to create remote directories"
|
|
notify_failure "Remote directory creation"
|
|
fi
|
|
|
|
# 배포 파일 전송 (재시도)
|
|
for file in quantengine.tar.gz:quantengine.tar.gz tools/deploy_quantengine.sh:deploy.sh deploy/quantengine.env:quantengine.env; do
|
|
IFS=':' read -r SRC DST <<< "$file"
|
|
echo "📤 Transferring $SRC..."
|
|
|
|
for attempt in 1 2 3; do
|
|
if scp -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
|
|
"$SRC" "$DEPLOY_USER@$DEPLOY_SSH_HOST:/home/kjh2064/tmp/$DST" 2>&1; then
|
|
echo "✓ Transferred $SRC"
|
|
break
|
|
elif [ $attempt -lt 3 ]; then
|
|
echo " Retry $attempt failed, waiting 5s..."
|
|
sleep 5
|
|
else
|
|
echo "❌ Failed to transfer $SRC after 3 attempts"
|
|
notify_failure "File transfer ($SRC)"
|
|
fi
|
|
done
|
|
done
|
|
|
|
# 배포 스크립트 실행 (재시도) - SSH 직접 IP 사용
|
|
echo "🚀 Running deployment script..."
|
|
for attempt in 1 2; do
|
|
if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_SSH_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"; then
|
|
echo "✓ Deployment script executed successfully"
|
|
break
|
|
elif [ $attempt -lt 2 ]; then
|
|
echo "⚠️ First attempt failed, retrying..."
|
|
sleep 10
|
|
else
|
|
echo "❌ Deployment script failed after 2 attempts"
|
|
notify_failure "Deployment script execution"
|
|
fi
|
|
done
|
|
|
|
# 환경 파일 설치 - SSH 직접 IP 사용
|
|
echo "⚙️ Installing environment configuration..."
|
|
if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
|
|
"$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"; then
|
|
echo "❌ Failed to install configuration"
|
|
notify_failure "Configuration installation"
|
|
fi
|
|
|
|
# 서비스 안정화 대기
|
|
echo "⏳ Waiting for service stabilization (15s)..."
|
|
sleep 15
|
|
|
|
echo "=== Verifying Loopback Health ==="
|
|
loopback_headers=""
|
|
for i in 1 2 3; do
|
|
echo " Health check attempt $i..."
|
|
loopback_headers=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" "curl -s -D - -o /dev/null -m 5 http://127.0.0.1:5000/" 2>&1)
|
|
|
|
if printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] (200|30[12]|401) '; then
|
|
echo "✓ Loopback health check passed (auth required)"
|
|
break
|
|
elif [ $i -lt 3 ]; then
|
|
echo " Waiting 5s for service..."
|
|
sleep 5
|
|
fi
|
|
done
|
|
|
|
if ! printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] '; then
|
|
echo "❌ Loopback health check failed"
|
|
echo "Response: $loopback_headers"
|
|
notify_failure "Health check (loopback)"
|
|
fi
|
|
|
|
if ! printf '%s' "$loopback_headers" | grep -qiE '(^Location: /login|^HTTP/1\.[01] 200 )'; then
|
|
echo "⚠️ Unexpected redirect, but service is responding"
|
|
fi
|
|
|
|
echo "=== Verifying Favicon Assets ==="
|
|
favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.svg")
|
|
favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.png")
|
|
echo "/favicon.svg -> ${favicon_svg_code}"
|
|
echo "/favicon.png -> ${favicon_png_code}"
|
|
if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ] && [ "$favicon_svg_code" != "302" ] && [ "$favicon_png_code" != "302" ]; then
|
|
echo "Favicon assets are not reachable after deploy (received SVG:$favicon_svg_code, PNG:$favicon_png_code)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Verifying Public Routes ==="
|
|
public_root_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/")
|
|
login_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/login")
|
|
|
|
public_root_code=$(printf '%s' "$public_root_headers" | awk 'NR==1 {print $2}')
|
|
login_code=$(printf '%s' "$login_headers" | awk 'NR==1 {print $2}')
|
|
|
|
echo "https://quant.taxbaik.com/ -> ${public_root_code}"
|
|
echo "https://quant.taxbaik.com/login -> ${login_code}"
|
|
|
|
if [ "$public_root_code" != "302" ] && [ "$public_root_code" != "200" ] && [ "$public_root_code" != "401" ]; then
|
|
echo "Deployment content check failed for public root (received $public_root_code)" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$login_code" != "200" ]; then
|
|
echo "Deployment content check failed for login page" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
|
|
send_telegram "✅ <b>QuantEngine 배포 완료</b>
|
|
|
|
커밋: <code>${COMMIT}</code>
|
|
시간: <code>${TIMESTAMP}</code>
|
|
대상: <code>${DEPLOY_HOST}</code>"
|