GitHub Actions CI/CD 완전 정복: Go 빌드부터 브랜치 전략, 자동 배포까지

Workflow (.github/workflows/*.yml)
  └── Job (하나의 Runner에서 실행)
        └── Step (순차 실행)
              └── Action (재사용 가능한 단위 작업)

on:
  # 코드 푸시 시
  push:
    branches: [main, develop]
    paths:
      - 'src/**'
      - 'go.mod'
    tags:
      - 'v*'

  # PR 이벤트
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

  # 크론 스케줄 (UTC 기준)
  schedule:
    - cron: '0 2 * * 1' # 매주 월요일 02:00 UTC

  # 수동 트리거 (UI 버튼)
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deploy target'
        required: true
        type: choice
        options:
          - staging
          - production

  # API 호출로 트리거
  repository_dispatch:
    types: [deploy-trigger]

concurrency:
  group: deploy-production
  cancel-in-progress: false  # 진행 중인 배포는 취소하지 않음

# 또는 PR 단위로
concurrency:
  group: ci-pr-$GITHUB_REF
  cancel-in-progress: true  # 새 커밋 시 이전 CI 취소

name: CI Pipeline

env:
  GO_VERSION: '1.23'
  REGISTRY: ghcr.io

jobs:
  test:
    runs-on: ubuntu-latest
    # 조건부 실행
    if: github.event_name == 'pull_request'
    strategy:
      matrix:
        go-version: ['1.22', '1.23']
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
      - run: go test ./...

  build:
    needs: [test] # test Job 완료 후 실행
    runs-on: ubuntu-latest
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    steps:
      - id: meta
        run: echo "tags=v1.0.0" >> "$GITHUB_OUTPUT"

# 1. 소스 코드 체크아웃
- uses: actions/checkout@v4
  with:
    fetch-depth: 0 # 전체 히스토리 (태그 기반 버전에 필요)

# 2. Go 설정
- uses: actions/setup-go@v5
  with:
    go-version: '1.23'
    cache: true # Go 모듈 캐시 자동 활성화

# 3. 캐시 관리
- uses: actions/cache@v4
  with:
    path: |
      ~/.cache/go-build
      ~/go/pkg/mod
    key: go-mod-${{ hashFiles('**/go.sum') }}
    restore-keys: |
      go-mod-

# 4. Docker 레지스트리 로그인
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# 5. Docker 빌드 & 푸시
- uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    tags: ghcr.io/myorg/myapp:latest
    cache-from: type=gha
    cache-to: type=gha,mode=max

# 6. Docker 메타데이터 (태그 자동 생성)
- uses: docker/metadata-action@v5
  with:
    images: ghcr.io/myorg/myapp
    tags: |
      type=sha,prefix=
      type=ref,event=branch
      type=semver,pattern=v{{version}}

# 7. 아티팩트 업로드
- uses: actions/upload-artifact@v4
  with:
    name: go-binary-linux
    path: ./bin/myapp
    retention-days: 5

# 8. 아티팩트 다운로드
- uses: actions/download-artifact@v4
  with:
    name: go-binary-linux
    path: ./bin/

# 9. golangci-lint
- uses: golangci/golangci-lint-action@v6
  with:
    version: v1.62
    args: --timeout=5m

# 10. CodeQL 분석
- uses: github/codeql-action/analyze@v3
  with:
    languages: go

# 11. Dependency Review (PR에서 새 의존성 검토)
- uses: actions/dependency-review-action@v4

# 12. GitHub Release 생성
- uses: softprops/action-gh-release@v2
  with:
    files: dist/*
    generate_release_notes: true

# 13. PR 라벨 자동 부여
- uses: actions/labeler@v5
  with:
    repo-token: ${{ secrets.GITHUB_TOKEN }}

# 14. Slack 알림
- uses: slackapi/slack-github-action@v2
  with:
    webhook: ${{ secrets.SLACK_WEBHOOK }}
    webhook-type: incoming-webhook
    payload: |
      {
        "text": "Deployment complete: ${{ github.sha }}"
      }

# .github/actions/go-setup/action.yml
name: 'Go Setup with Cache'
description: 'Setup Go with module and build cache'
inputs:
  go-version:
    description: 'Go version'
    required: false
    default: '1.23'
runs:
  using: 'composite'
  steps:
    - uses: actions/setup-go@v5
      with:
        go-version: ${{ inputs.go-version }}
    - uses: actions/cache@v4
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
      shell: bash
    - run: go mod download
      shell: bash

jobs:
  deploy:
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions
          aws-region: ap-northeast-2

      # GCP도 마찬가지
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/github/providers/github
          service_account: github-actions@my-project.iam.gserviceaccount.com

jobs:
  deploy-prod:
    environment:
      name: production
      url: https://myapp.example.com
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: echo "Deploying to production..."

# 기본 빌드
go build -o bin/myapp ./cmd/myapp

# 프로덕션 빌드 (최적화 플래그)
CGO_ENABLED=0 go build \
  -trimpath \
  -ldflags="-s -w -X main.version=v1.2.3 -X main.commit=abc123 -X main.buildDate=2026-03-23" \
  -o bin/myapp \
  ./cmd/myapp

# Linux AMD64
GOOS=linux GOARCH=amd64 go build -o bin/myapp-linux-amd64 ./cmd/myapp

# macOS ARM64 (Apple Silicon)
GOOS=darwin GOARCH=arm64 go build -o bin/myapp-darwin-arm64 ./cmd/myapp

# Windows AMD64
GOOS=windows GOARCH=amd64 go build -o bin/myapp-windows-amd64.exe ./cmd/myapp

# Linux ARM64 (AWS Graviton, Raspberry Pi)
GOOS=linux GOARCH=arm64 go build -o bin/myapp-linux-arm64 ./cmd/myapp

# 기본 테스트
go test ./...

# 레이스 컨디션 탐지 + 커버리지
go test -race -cover -coverprofile=coverage.out ./...

# 벤치마크
go test -bench=. -benchmem -count=5 ./...

# 특정 테스트만 실행
go test -run TestUserService -v ./internal/service/

# 병렬 실행 제어
go test -parallel=4 ./...

# 타임아웃 설정
go test -timeout=5m ./...

# 커버리지 리포트 생성
go tool cover -html=coverage.out -o coverage.html

# go vet: 컴파일러가 잡지 못하는 의심스러운 코드 탐지
go vet ./...

# staticcheck: 고급 정적 분석
staticcheck ./...

# golangci-lint: 50+ 린터 통합 도구
golangci-lint run --timeout=5m

# 보안 취약점 스캔
govulncheck ./...

# .golangci.yml
run:
  timeout: 5m
  go: '1.23'

linters:
  enable:
    - errcheck
    - gosimple
    - govet
    - ineffassign
    - staticcheck
    - unused
    - gosec
    - revive
    - misspell
    - prealloc
    - exportloopref
    - gocritic

linters-settings:
  errcheck:
    check-type-assertions: true
  gocritic:
    enabled-tags:
      - diagnostic
      - performance
      - style
  revive:
    rules:
      - name: unexported-return
        disabled: true

issues:
  exclude-rules:
    - path: _test\.go
      linters:
        - errcheck
        - gosec

# 의존성 정리
go mod tidy

# 벤더링 (CI에서 네트워크 의존성 제거)
go mod vendor

# 의존성 보안 스캔
govulncheck ./...

# 의존성 그래프 확인
go mod graph

# 특정 모듈 업데이트
go get -u github.com/gin-gonic/gin@latest

name: Go CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  GO_VERSION: '1.23'
  GOLANGCI_LINT_VERSION: 'v1.62'

permissions:
  contents: read
  pull-requests: write

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      - uses: golangci/golangci-lint-action@v6
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          args: --timeout=5m
      - name: Check go mod tidy
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

  test:
    name: Test (Go ${{ matrix.go-version }} / ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        go-version: ['1.22', '1.23']
        os: [ubuntu-latest, macos-latest, windows-latest]
        exclude:
          - os: windows-latest
            go-version: '1.22'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          cache: true

      - name: Run tests with coverage
        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...

      - name: Upload coverage
        if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.23'
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage.out

  coverage-report:
    name: Coverage Report
    needs: [test]
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: coverage
      - name: Generate coverage comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const coverage = fs.readFileSync('coverage.out', 'utf8');
            const lines = coverage.split('\n');
            const total = lines.length - 2;
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `## Coverage Report\nTotal statements covered: ${total} lines\nSee artifacts for full report.`
            });

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...
      - name: Run gosec
        uses: securego/gosec@master
        with:
          args: ./...

  build:
    name: Build
    needs: [lint, test]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux, darwin, windows]
        goarch: [amd64, arm64]
        exclude:
          - goos: windows
            goarch: arm64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: '0'
        run: |
          VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo "dev")
          COMMIT=$(git rev-parse --short HEAD)
          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          EXTENSION=""
          if [ "$GOOS" = "windows" ]; then
            EXTENSION=".exe"
          fi
          go build \
            -trimpath \
            -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.buildDate=${BUILD_DATE}" \
            -o "bin/myapp-${GOOS}-${GOARCH}${EXTENSION}" \
            ./cmd/myapp

      - uses: actions/upload-artifact@v4
        with:
          name: binary-${{ matrix.goos }}-${{ matrix.goarch }}
          path: bin/
          retention-days: 7

# actions/setup-go의 내장 캐시 (go.sum 해시 기반)
- uses: actions/setup-go@v5
  with:
    go-version: '1.23'
    cache: true # 이것만으로 go module 캐시 활성화

# 더 세밀한 캐시 제어가 필요할 때
- uses: actions/cache@v4
  with:
    path: |
      ~/.cache/go-build
      ~/go/pkg/mod
    key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
    restore-keys: |
      go-${{ runner.os }}-

# ============================================
# Stage 1: Build
# ============================================
FROM golang:1.23-alpine AS builder

# 빌드에 필요한 도구 설치
RUN apk add --no-cache git ca-certificates tzdata

WORKDIR /app

# 의존성 먼저 복사 (레이어 캐싱 최적화)
COPY go.mod go.sum ./
RUN go mod download

# 소스 코드 복사
COPY . .

# 빌드 (정적 바이너리)
ARG VERSION=dev
ARG COMMIT=unknown
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT}" \
    -o /app/bin/server \
    ./cmd/server

# ============================================
# Stage 2: Runtime (Scratch - 최소 이미지)
# ============================================
FROM scratch

# TLS 인증서 (HTTPS 호출에 필요)
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
# 타임존 데이터
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
# 바이너리
COPY --from=builder /app/bin/server /server

# 비-root 사용자 (보안)
USER 65534:65534

EXPOSE 8080
ENTRYPOINT ["/server"]

FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=builder /app/bin/server /server

USER nonroot:nonroot

EXPOSE 8080
ENTRYPOINT ["/server"]

jobs:
  docker:
    name: Build and Push Docker Image
    needs: [test, lint]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU (멀티 플랫폼 빌드)
        uses: docker/setup-qemu-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}

# 방법 1: GitHub Actions Cache Backend (추천)
cache-from: type=gha
cache-to: type=gha,mode=max

# 방법 2: Registry Cache
cache-from: type=registry,ref=ghcr.io/myorg/myapp:cache
cache-to: type=registry,ref=ghcr.io/myorg/myapp:cache,mode=max

# 비-root 사용자 실행
USER 65534:65534

# 읽기 전용 파일시스템 (Kubernetes에서)
# securityContext:
#   readOnlyRootFilesystem: true

# 헬스 체크
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD ["/server", "healthcheck"]

# .goreleaser.yaml
version: 2

before:
  hooks:
    - go mod tidy
    - go generate ./...

builds:
  - id: myapp
    main: ./cmd/myapp
    binary: myapp
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}

archives:
  - id: default
    format: tar.gz
    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
    format_overrides:
      - goos: windows
        format: zip

checksum:
  name_template: 'checksums.txt'

changelog:
  sort: asc
  filters:
    exclude:
      - '^docs:'
      - '^test:'
      - '^ci:'
      - Merge pull request

brews:
  - repository:
      owner: myorg
      name: homebrew-tap
    homepage: https://github.com/myorg/myapp
    description: My application
    license: MIT

dockers:
  - image_templates:
      - 'ghcr.io/myorg/myapp:{{ .Version }}-amd64'
    dockerfile: Dockerfile
    build_flag_templates:
      - '--platform=linux/amd64'
    use: buildx

nfpms:
  - package_name: myapp
    vendor: My Organization
    homepage: https://github.com/myorg/myapp
    maintainer: team@myorg.com
    description: My application
    license: MIT
    formats:
      - deb
      - rpm

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

feat: add user authentication       → v1.1.0 (MINOR)
fix: resolve null pointer error     → v1.0.1 (PATCH)
feat!: redesign API endpoints       → v2.0.0 (MAJOR)

# .github/workflows/semantic-release.yml
name: Semantic Release

on:
  push:
    branches: [main]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@v4
        with:
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/git
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

main ─────────────────────────────────────────→
  ↑                    ↑                    ↑
  │ merge              │ merge              │ hotfix
  │                    │                    │
release/1.0 ─→    release/2.0 ─→        hotfix/urgent ─→
  ↑                    ↑
  │ merge              │ merge
  │                    │
develop ──────────────────────────────────────→
  ↑         ↑         ↑
  │         │         │
feature/A  feature/B  feature/C

# Git Flow용 CI 워크플로우
name: Git Flow CI

on:
  push:
    branches:
      - main
      - develop
      - 'feature/**'
      - 'release/**'
      - 'hotfix/**'
  pull_request:
    branches: [main, develop]

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'
      - run: go test ./...

      # release 또는 hotfix 브랜치에서만 빌드
      - name: Build
        if: startsWith(github.ref, 'refs/heads/release/') || startsWith(github.ref, 'refs/heads/hotfix/')
        run: go build -o bin/myapp ./cmd/myapp

      # main 브랜치에서만 배포
      - name: Deploy
        if: github.ref == 'refs/heads/main'
        run: echo "Deploying to production..."

main ─── PR1 merge ─── PR2 merge ─── PR3 merge ──→
  ↑         ↑            ↑            ↑
  │         │            │            │
  └─ feat/A ┘      feat/B ┘     fix/C ┘

# GitHub Flow용 CI/CD
name: GitHub Flow CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'
      - run: golangci-lint run
      - run: go test -race ./...

  deploy:
    needs: [ci]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment:
      name: production
      url: https://myapp.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Build and Deploy
        run: |
          go build -o bin/myapp ./cmd/myapp
          echo "Deploying to production..."

main ── A ── B ── C ── D ── E ── F ── G ── H ──→
             ↑              ↑         ↑
             │              │         │
        short/feat     short/fix   short/feat
        (1-2일)        (수시간)     (1일)

package feature

import "os"

type Flags struct {
    NewDashboard   bool
    BetaAPI        bool
    DarkMode       bool
}

func LoadFlags() Flags {
    return Flags{
        NewDashboard: os.Getenv("FF_NEW_DASHBOARD") == "true",
        BetaAPI:      os.Getenv("FF_BETA_API") == "true",
        DarkMode:     os.Getenv("FF_DARK_MODE") == "true",
    }
}

// 사용 예
func HandleDashboard(w http.ResponseWriter, r *http.Request) {
    flags := LoadFlags()
    if flags.NewDashboard {
        renderNewDashboard(w, r)
    } else {
        renderLegacyDashboard(w, r)
    }
}

Settings → Branches → Branch protection rules → Add rule
- Branch name pattern: main
- Require a pull request before merging
  - Required approving reviews: 2
  - Dismiss stale reviews when new commits are pushed
  - Require review from Code Owners

- Require status checks to pass before merging
  - ci / lint (Required)
  - ci / test (Required)
  - ci / security (Required)

# .github/CODEOWNERS

# 전체 리포지토리 기본 리뷰어
* @myorg/backend-team

# Go 코드
*.go @myorg/go-team

# 인프라 코드
.github/ @myorg/devops-team
Dockerfile @myorg/devops-team
k8s/ @myorg/devops-team

# API 스펙
api/ @myorg/api-team @myorg/backend-team

# 보안 관련
**/security* @myorg/security-team

Settings → Rules → Rulesets → New ruleset
- Name: Production Protection
- Enforcement: Active
- Bypass list: @myorg/release-managers
- Target branches: main, release/*
- Rules:
  - Require a pull request
  - Require status checks (ci/lint, ci/test)
  - Require signed commits
  - Block force pushes
  - Require linear history

Developer Push
      │
      ▼
┌─────────────────┐
│   Lint Job      │ ← golangci-lint, go vet
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Test Job      │ ← unit test, integration test, coverage
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Build Job     │ ← cross-compile, GoReleaser
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Docker Job    │ ← multi-stage build, GHCR push
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Deploy Job    │ ← K8s rollout, canary
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Smoke Test Job │ ← health check, API validation
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Notify Job     │ ← Slack webhook
└─────────────────┘

name: Go Microservice Full Pipeline

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

concurrency:
  group: pipeline-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  GO_VERSION: '1.23'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  K8S_NAMESPACE: production

permissions:
  contents: read

# ============================================
# Job 1: Lint
# ============================================
jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.62
          args: --timeout=5m --issues-exit-code=1

      - name: go vet
        run: go vet ./...

      - name: Check formatting
        run: |
          gofmt_output=$(gofmt -l .)
          if [ -n "$gofmt_output" ]; then
            echo "Files not formatted:"
            echo "$gofmt_output"
            exit 1
          fi

      - name: Check go.mod tidy
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

  # ============================================
  # Job 2: Test
  # ============================================
  test:
    name: Test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run unit tests
        run: |
          go test -race -count=1 \
            -coverprofile=coverage-unit.out \
            -covermode=atomic \
            $(go list ./... | grep -v /integration/)
        env:
          ENVIRONMENT: test

      - name: Run integration tests
        run: |
          go test -race -count=1 \
            -coverprofile=coverage-integration.out \
            -covermode=atomic \
            -tags=integration \
            ./internal/integration/...
        env:
          DATABASE_URL: postgres://test:test@localhost:5432/testdb?sslmode=disable
          REDIS_URL: redis://localhost:6379

      - name: Merge coverage
        run: |
          go install github.com/wadey/gocovmerge@latest
          gocovmerge coverage-unit.out coverage-integration.out > coverage.out
          go tool cover -func=coverage.out | tail -1

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage.out

  # ============================================
  # Job 3: Security Scan
  # ============================================
  security:
    name: Security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: gosec
        uses: securego/gosec@master
        with:
          args: '-no-fail -fmt json -out gosec-report.json ./...'

      - name: Upload security report
        uses: actions/upload-artifact@v4
        with:
          name: security-report
          path: gosec-report.json

  # ============================================
  # Job 4: Build
  # ============================================
  build:
    name: Build
    needs: [lint, test, security]
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Determine version
        id: version
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            VERSION="dev-$(git rev-parse --short HEAD)"
          fi
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "Building version: ${VERSION}"

      - name: Build binaries
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          COMMIT="$(git rev-parse --short HEAD)"
          DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          LDFLAGS="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.buildDate=${DATE}"

          for OS in linux darwin; do
            for ARCH in amd64 arm64; do
              echo "Building ${OS}/${ARCH}..."
              CGO_ENABLED=0 GOOS=${OS} GOARCH=${ARCH} \
                go build -trimpath -ldflags="${LDFLAGS}" \
                -o "bin/myapp-${OS}-${ARCH}" ./cmd/myapp
            done
          done

      - uses: actions/upload-artifact@v4
        with:
          name: binaries
          path: bin/

  # ============================================
  # Job 5: Docker Build & Push
  # ============================================
  docker:
    name: Docker
    needs: [build]
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write
    outputs:
      image-digest: ${{ steps.build-push.outputs.digest }}
      image-tag: ${{ steps.meta.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        id: build-push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.build.outputs.version }}
            COMMIT=${{ github.sha }}

  # ============================================
  # Job 6: Deploy to Kubernetes
  # ============================================
  deploy:
    name: Deploy
    needs: [docker]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
    permissions:
      id-token: write
      contents: read
    environment:
      name: production
      url: https://myapp.example.com
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: ap-northeast-2

      - name: Setup kubectl
        uses: azure/setup-kubectl@v4
        with:
          version: 'v1.30.0'

      - name: Update kubeconfig
        run: aws eks update-kubeconfig --name my-cluster --region ap-northeast-2

      - name: Deploy with canary
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.docker.outputs.image-digest }}"

          # 카나리 배포 (10% 트래픽)
          kubectl set image deployment/myapp-canary \
            myapp="${IMAGE}" \
            -n ${{ env.K8S_NAMESPACE }}
          kubectl rollout status deployment/myapp-canary \
            -n ${{ env.K8S_NAMESPACE }} --timeout=120s

          # 카나리 검증 (5분 대기 후 메트릭 확인)
          echo "Waiting for canary metrics..."
          sleep 60

          # 전체 롤아웃
          kubectl set image deployment/myapp \
            myapp="${IMAGE}" \
            -n ${{ env.K8S_NAMESPACE }}
          kubectl rollout status deployment/myapp \
            -n ${{ env.K8S_NAMESPACE }} --timeout=300s

  # ============================================
  # Job 7: Smoke Test
  # ============================================
  smoke-test:
    name: Smoke Test
    needs: [deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Health check
        run: |
          for i in $(seq 1 10); do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://myapp.example.com/health)
            if [ "$STATUS" = "200" ]; then
              echo "Health check passed (attempt $i)"
              exit 0
            fi
            echo "Attempt $i failed (status: $STATUS), retrying..."
            sleep 10
          done
          echo "Health check failed after 10 attempts"
          exit 1

      - name: API validation
        run: |
          # 기본 API 엔드포인트 검증
          curl -sf https://myapp.example.com/api/v1/version | jq .
          curl -sf https://myapp.example.com/api/v1/ready

  # ============================================
  # Job 8: Notification
  # ============================================
  notify:
    name: Notify
    needs: [smoke-test]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Slack notification
        uses: slackapi/slack-github-action@v2
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "${{ needs.smoke-test.result == 'success' && 'Deployment successful' || 'Deployment failed' }} for *${{ github.repository }}*\n*Branch:* ${{ github.ref_name }}\n*Commit:* ${{ github.sha }}\n*Author:* ${{ github.actor }}"
                  }
                }
              ]
            }

  # ============================================
  # Job 9: Rollback (실패 시)
  # ============================================
  rollback:
    name: Rollback
    needs: [smoke-test]
    runs-on: ubuntu-latest
    if: failure()
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: ap-northeast-2

      - name: Setup kubectl
        uses: azure/setup-kubectl@v4

      - name: Rollback deployment
        run: |
          aws eks update-kubeconfig --name my-cluster --region ap-northeast-2
          kubectl rollout undo deployment/myapp -n ${{ env.K8S_NAMESPACE }}
          kubectl rollout status deployment/myapp -n ${{ env.K8S_NAMESPACE }} --timeout=120s
          echo "Rollback completed successfully"

# .github/workflows/go-ci-reusable.yml
name: Go CI (Reusable)

on:
  workflow_call:
    inputs:
      go-version:
        description: 'Go version to use'
        required: false
        type: string
        default: '1.23'
      working-directory:
        description: 'Working directory'
        required: false
        type: string
        default: '.'
      run-integration-tests:
        description: 'Run integration tests'
        required: false
        type: boolean
        default: false
    secrets:
      SLACK_WEBHOOK:
        required: false
    outputs:
      coverage:
        description: 'Test coverage percentage'
        value: ${{ jobs.test.outputs.coverage }}

jobs:
  lint:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ inputs.go-version }}
      - uses: golangci/golangci-lint-action@v6
        with:
          version: v1.62
          working-directory: ${{ inputs.working-directory }}

  test:
    runs-on: ubuntu-latest
    outputs:
      coverage: ${{ steps.coverage.outputs.total }}
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ inputs.go-version }}
          cache: true

      - name: Unit tests
        run: go test -race -coverprofile=coverage.out ./...

      - name: Integration tests
        if: inputs.run-integration-tests
        run: go test -race -tags=integration ./internal/integration/...

      - name: Coverage
        id: coverage
        run: |
          TOTAL=$(go tool cover -func=coverage.out | tail -1 | awk '{print $3}')
          echo "total=${TOTAL}" >> "$GITHUB_OUTPUT"

# service-a/.github/workflows/ci.yml
name: Service A CI

on:
  push:
    branches: [main]
    paths:
      - 'services/service-a/**'
  pull_request:
    paths:
      - 'services/service-a/**'

jobs:
  ci:
    uses: myorg/shared-workflows/.github/workflows/go-ci-reusable.yml@main
    with:
      go-version: '1.23'
      working-directory: services/service-a
      run-integration-tests: true
    secrets:
      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

name: Monorepo CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      services: ${{ steps.changes.outputs.changes }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            user-service:
              - 'services/user/**'
            order-service:
              - 'services/order/**'
            payment-service:
              - 'services/payment/**'
            shared-lib:
              - 'pkg/**'

  build-user:
    needs: [detect-changes]
    if: needs.detect-changes.outputs.services == 'true' || contains(needs.detect-changes.outputs.services, 'user-service') || contains(needs.detect-changes.outputs.services, 'shared-lib')
    uses: ./.github/workflows/go-ci-reusable.yml
    with:
      working-directory: services/user

  build-order:
    needs: [detect-changes]
    if: contains(needs.detect-changes.outputs.services, 'order-service') || contains(needs.detect-changes.outputs.services, 'shared-lib')
    uses: ./.github/workflows/go-ci-reusable.yml
    with:
      working-directory: services/order

deploy-staging:
  environment:
    name: staging
  # staging은 자동 배포

deploy-production:
  needs: [deploy-staging]
  environment:
    name: production # GitHub UI에서 승인 필요
    url: https://myapp.example.com
  # production은 승인 후 배포

name: Rollback

on:
  workflow_dispatch:
    inputs:
      revision:
        description: 'Rollback to revision (0 for previous)'
        required: false
        default: '0'
      service:
        description: 'Service to rollback'
        required: true
        type: choice
        options:
          - user-service
          - order-service
          - payment-service

jobs:
  rollback:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Configure kubectl
        run: |
          aws eks update-kubeconfig --name my-cluster

      - name: Rollback
        run: |
          REVISION="${{ github.event.inputs.revision }}"
          SERVICE="${{ github.event.inputs.service }}"
          if [ "$REVISION" = "0" ]; then
            kubectl rollout undo deployment/${SERVICE} -n production
          else
            kubectl rollout undo deployment/${SERVICE} --to-revision=${REVISION} -n production
          fi
          kubectl rollout status deployment/${SERVICE} -n production --timeout=120s

# 이미지 푸시
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
# 이미지 네이밍 컨벤션
# ghcr.io/OWNER/REPO:TAG
# ghcr.io/myorg/user-service:v1.2.3
# ghcr.io/myorg/user-service:sha-abc1234
# ghcr.io/myorg/user-service:main

# Go Module Cache
- uses: actions/cache@v4
  with:
    path: ~/go/pkg/mod
    key: gomod-${{ runner.os }}-${{ hashFiles('**/go.sum') }}

# Go Build Cache
- uses: actions/cache@v4
  with:
    path: ~/.cache/go-build
    key: gobuild-${{ runner.os }}-${{ hashFiles('**/*.go') }}
    restore-keys: |
      gobuild-${{ runner.os }}-

# Docker Layer Cache (GitHub Actions backend)
- uses: docker/build-push-action@v6
  with:
    cache-from: type=gha
    cache-to: type=gha,mode=max

# npm Cache (프론트엔드가 있는 경우)
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}

# 좋은 설계: 독립적인 Job은 병렬 실행
jobs:
  lint: # ──┐
    ... #   ├── 병렬
  test: # ──┤
    ... #   ├── 병렬
  security: # ──┘
    ...

  build:
    needs: [lint, test, security] # 위 3개 모두 완료 후

  docker:
    needs: [build] # 순차

  deploy:
    needs: [docker] # 순차

# actions-runner-controller (ARC)로 K8s에서 Self-hosted Runner 운영
# AWS Spot Instance 기반으로 비용 절약

# runner-deployment.yaml (Kubernetes)
# ARC를 사용하면 워크플로우 수요에 따라
# Runner가 자동으로 스케일 업/다운됩니다.

일일 빌드 횟수: 50회
평균 빌드 시간: 8분
Linux Runner 사용

일일 비용: 50 x 8 x $0.008 = $3.20
월간 비용: $3.20 x 22일(영업일) = $70.40
연간 비용: $70.40 x 12 = $844.80

- name: Check for changes
  id: changes
  run: |
    if git diff --name-only HEAD~1 | grep -q "^src/"; then
      echo "changed=true" >> "$GITHUB_OUTPUT"
    else
      echo "changed=false" >> "$GITHUB_OUTPUT"
    fi

- name: Build
  if: steps.changes.outputs.changed == 'true'
  run: go build ./...

strategy:
  matrix:
    include:
      # PR에서는 최소한의 조합만
      - os: ubuntu-latest
        go: '1.23'
      # main에서는 전체 매트릭스
      - os: macos-latest
        go: '1.23'
        if: github.ref == 'refs/heads/main'

jobs:
  test:
    timeout-minutes: 15
    steps:
      - name: Test
        timeout-minutes: 10
        run: go test ./...

- name: Track job timing
  run: |
    echo "Job started at: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
    START_TIME=$(date +%s)
    # ... 실제 작업 ...
    END_TIME=$(date +%s)
    DURATION=$((END_TIME - START_TIME))
    echo "Duration: ${DURATION} seconds"

# 최근 20회 실행 결과
gh run list --workflow=ci.yml --limit=20

# 실패한 실행만 필터
gh run list --workflow=ci.yml --status=failure --limit=10

# 특정 실행의 로그 확인
gh run view 12345678 --log

ACTIONS_STEP_DEBUG = true
ACTIONS_RUNNER_DEBUG = true

on:
  workflow_dispatch:

# GitHub UI에서 "Enable debug logging" 체크박스 선택

# 설치 (macOS)
brew install act

# 기본 실행 (push 이벤트)
act push

# 특정 Job만 실행
act -j test

# 시크릿 전달
act push --secret-file .env.secrets

# 특정 이벤트 데이터로 실행
act pull_request --eventpath event.json

# 사용 가능한 워크플로우 목록
act -l

feat: 새 기능 추가 (MINOR 버전 증가)
fix: 버그 수정 (PATCH 버전 증가)
docs: 문서 변경
style: 코드 포맷팅 (기능 변경 없음)
refactor: 리팩토링 (기능 변경 없음)
perf: 성능 개선
test: 테스트 추가/수정
ci: CI 설정 변경
chore: 기타 변경

# Breaking Change (MAJOR 버전 증가)
feat!: API 엔드포인트 변경

name: Commit Lint

on:
  pull_request:

jobs:
  commitlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: wagoid/commitlint-github-action@v6
        with:
          configFile: .commitlintrc.yml

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: gomod
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 10
    reviewers:
      - myorg/backend-team
    labels:
      - dependencies
      - go
    commit-message:
      prefix: 'deps'

  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly
    labels:
      - dependencies
      - docker

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    labels:
      - dependencies
      - ci

# 1. 최소 권한 원칙
permissions:
  contents: read  # 기본적으로 읽기만

# 2. Action 버전 SHA 고정
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

# 3. 외부 Action 감사
# Marketplace Action 사용 전 소스 코드 확인

# 4. OpenSSF Scorecard
- uses: ossf/scorecard-action@v2
  with:
    results_file: scorecard-results.sarif