풀스택 개발자를 위한 CI/CD 6강 — 배포 자동화: 서버 배포와 플랫폼 배포

/srv/app/
├── compose.yaml        # 서비스 정의
├── .env                # 런타임 비밀값 (권한 600)
├── deploy.sh           # 배포 스크립트
└── releases.log        # 배포 이력

services:
  app:
    image: ghcr.io/my-org/my-app:${IMAGE_TAG:?IMAGE_TAG is required}
    restart: unless-stopped
    env_file: .env
    environment:
      APP_VERSION: ${IMAGE_TAG}
    ports:
      - "127.0.0.1:3000:3000"      # 외부에 직접 노출하지 않고 리버스 프록시 뒤에 둠
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 20s
    stop_grace_period: 30s

sudo useradd -m -s /bin/bash deploy
sudo usermod -aG docker deploy
sudo mkdir -p /srv/app && sudo chown deploy:deploy /srv/app

command="/srv/app/deploy.sh",no-port-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAA... ci-deploy

echo "$GHCR_READ_TOKEN" | docker login ghcr.io -u <username> --password-stdin

#!/usr/bin/env bash
# /srv/app/deploy.sh
set -euo pipefail
 
# forced command로 실행되면 클라이언트가 보낸 명령이 SSH_ORIGINAL_COMMAND에 담김
# ("/srv/app/deploy.sh <SHA>" 형태이므로 마지막 단어를 태그로 사용)
if [[ -n "${SSH_ORIGINAL_COMMAND:-}" ]]; then
  TAG="${SSH_ORIGINAL_COMMAND##* }"
else
  TAG="${1:-}"
fi
 
# 태그 형식 검증 (40자리 커밋 SHA만 허용)
if [[ ! "$TAG" =~ ^[0-9a-f]{40}$ ]]; then
  echo "유효하지 않은 태그: '$TAG'" >&2
  exit 1
fi
 
cd /srv/app
export IMAGE_TAG="$TAG"
 
echo "==> 이미지 받기: $IMAGE_TAG"
docker compose pull app
 
echo "==> 컨테이너 교체"
docker compose up -d --wait --wait-timeout 90 app
 
echo "==> 헬스체크"
for i in $(seq 1 15); do
  if curl -fsS http://127.0.0.1:3000/api/health | grep -q "$IMAGE_TAG"; then
    echo "$(date -Iseconds) $IMAGE_TAG" >> releases.log
    echo "==> 배포 성공"
    docker image prune -f --filter "until=168h" > /dev/null
    exit 0
  fi
  sleep 2
done
 
echo "==> 헬스체크 실패" >&2
exit 1

# 직전 성공 배포 확인
tail -n 2 /srv/app/releases.log
# 이전 태그로 다시 배포
/srv/app/deploy.sh <이전-커밋-SHA>

  deploy:
    needs: image
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: production
      url: https://app.example.com
    concurrency:
      group: deploy-production
      cancel-in-progress: false
    steps:
      - name: SSH 설정
        env:
          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
 
      - name: 배포
        env:
          HOST: ${{ secrets.DEPLOY_HOST }}
          TAG: ${{ github.sha }}
        run: |
          ssh -i ~/.ssh/deploy_key deploy@"$HOST" "/srv/app/deploy.sh $TAG"
 
      - name: 외부 스모크 테스트
        run: |
          curl -fsS --retry 5 --retry-delay 3 https://app.example.com/api/health

  deploy-vercel:
    needs: verify
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    env:
      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version-file: .nvmrc, cache: npm }
      - run: npm install --global vercel@latest
      - run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
      - run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
      - run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
 
jobs:
  preview:
    if: github.event.action != 'closed'
    # ... pr-${{ github.event.number }} 로 배포
  cleanup:
    if: github.event.action == 'closed'
    # ... docker compose -p pr-${{ github.event.number }} down

feat: 대시보드에 월별 KPI 필터 추가
fix: 주문 처리율 계산 시 0으로 나누는 오류 수정
feat!: 인증 API 응답 형식 변경

feat/fix 커밋 → main 머지 → 스테이징 자동 배포 (SHA 태그)
                   ↓
            릴리스 PR 머지 → v1.5.0 태그 → 운영 배포 (승인 후)