GitHub Actions 고급 CI/CD 워크플로우 — 매트릭스 빌드, 재사용 워크플로우, 셀프호스트 러너

name: Multi-Environment CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [18, 20, 22]
        include:
          - os: ubuntu-latest
            node-version: 22
            coverage: true
        exclude:
          - os: macos-latest
            node-version: 18
      fail-fast: false
      max-parallel: 6

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Upload coverage
        if: matrix.coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage/

name: Dynamic Matrix Build

on:
  push:
    branches: [main]

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Detect changed packages
        id: set-matrix
        run: |
          CHANGED=$(git diff --name-only HEAD~1 HEAD | grep '^packages/' | cut -d'/' -f2 | sort -u)
          if [ -z "$CHANGED" ]; then
            echo "matrix={\"package\":[\"core\"]}" >> $GITHUB_OUTPUT
          else
            PACKAGES=$(echo "$CHANGED" | jq -R -s -c 'split("\n") | map(select(. != ""))')
            echo "matrix={\"package\":$PACKAGES}" >> $GITHUB_OUTPUT
          fi

  build:
    needs: detect-changes
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Build ${{ matrix.package }}
        run: |
          echo "Building package: ${{ matrix.package }}"
          cd packages/${{ matrix.package }}
          npm ci && npm run build

# .github/workflows/reusable-docker-build.yml
name: Reusable Docker Build

on:
  workflow_call:
    inputs:
      image-name:
        required: true
        type: string
        description: 'Docker 이미지 이름'
      dockerfile-path:
        required: false
        type: string
        default: './Dockerfile'
        description: 'Dockerfile 경로'
      build-args:
        required: false
        type: string
        default: ''
        description: 'Docker 빌드 아규먼트'
      push-image:
        required: false
        type: boolean
        default: true
    secrets:
      REGISTRY_USERNAME:
        required: true
      REGISTRY_PASSWORD:
        required: true
    outputs:
      image-tag:
        description: '빌드된 이미지 태그'
        value: ${{ jobs.build.outputs.tag }}
      image-digest:
        description: '이미지 다이제스트'
        value: ${{ jobs.build.outputs.digest }}

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.meta.outputs.tags }}
      digest: ${{ steps.build-push.outputs.digest }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.image-name }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=semver,pattern={{version}}

      - name: Build and push
        id: build-push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ inputs.dockerfile-path }}
          push: ${{ inputs.push-image }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: ${{ inputs.build-args }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main]

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run lint && npm test

  build-api:
    needs: lint-and-test
    uses: ./.github/workflows/reusable-docker-build.yml
    with:
      image-name: ghcr.io/my-org/api-server
      dockerfile-path: ./services/api/Dockerfile
      build-args: NODE_ENV=production
    secrets:
      REGISTRY_USERNAME: ${{ secrets.GHCR_USERNAME }}
      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}

  build-web:
    needs: lint-and-test
    uses: ./.github/workflows/reusable-docker-build.yml
    with:
      image-name: ghcr.io/my-org/web-frontend
      dockerfile-path: ./services/web/Dockerfile
    secrets:
      REGISTRY_USERNAME: ${{ secrets.GHCR_USERNAME }}
      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}

  deploy:
    needs: [build-api, build-web]
    runs-on: ubuntu-latest
    steps:
      - name: Deploy with new images
        run: |
          echo "API image: ${{ needs.build-api.outputs.image-tag }}"
          echo "Web image: ${{ needs.build-web.outputs.image-tag }}"
          # kubectl set image 또는 Helm upgrade 등 실행

#!/bin/bash
# Self-hosted Runner 설치 스크립트 (Ubuntu)

# 1. 전용 사용자 생성
sudo useradd -m -s /bin/bash github-runner
sudo usermod -aG docker github-runner

# 2. 러너 디렉터리 생성 및 다운로드
sudo -u github-runner mkdir -p /home/github-runner/actions-runner
cd /home/github-runner/actions-runner

# 3. 최신 러너 패키지 다운로드 (v2.329.0 이상 필수)
RUNNER_VERSION="2.322.0"
curl -o actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz \
  -L https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz

tar xzf actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz

# 4. 러너 등록 (Ephemeral 모드 권장)
./config.sh \
  --url https://github.com/YOUR_ORG \
  --token YOUR_REGISTRATION_TOKEN \
  --name "prod-runner-01" \
  --labels "self-hosted,linux,x64,production" \
  --runnergroup "production-runners" \
  --ephemeral \
  --disableupdate

# 5. systemd 서비스 등록
sudo ./svc.sh install github-runner
sudo ./svc.sh start
sudo ./svc.sh status

# runner-deployment.yaml (ARC v0.27+)
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: production-runners
  namespace: github-runners
spec:
  replicas: 2
  template:
    spec:
      repository: my-org/my-repo
      labels:
        - self-hosted
        - linux
        - production
      ephemeral: true
      dockerEnabled: true
      resources:
        limits:
          cpu: '4'
          memory: '8Gi'
        requests:
          cpu: '2'
          memory: '4Gi'
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
  name: production-runners-autoscaler
  namespace: github-runners
spec:
  scaleTargetRef:
    kind: RunnerDeployment
    name: production-runners
  minReplicas: 1
  maxReplicas: 10
  scaleUpTriggers:
    - githubEvent:
        workflowJob: {}
      duration: '30m'
  scaleDownDelaySecondsAfterScaleOut: 300

name: Optimized Caching Pipeline

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # npm 캐시: package-lock.json 해시 기반
      - name: Cache npm dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-

      # Next.js 빌드 캐시
      - name: Cache Next.js build
        uses: actions/cache@v4
        with:
          path: .next/cache
          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**/*.js', '**/*.jsx', '**/*.ts', '**/*.tsx') }}
          restore-keys: |
            ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-
            ${{ runner.os }}-nextjs-

      # Docker 레이어 캐시 (Buildx)
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image with cache
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          tags: my-app:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # 아티팩트 업로드 (테스트 결과)
      - name: Run tests
        run: npm test -- --coverage

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ github.sha }}
          path: |
            coverage/
            test-results/
          retention-days: 30

name: Deploy to AWS with OIDC

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      # OIDC를 통한 AWS 인증 (장기 키 불필요)
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsDeployRole
          role-session-name: github-actions-deploy
          aws-region: ap-northeast-2

      - name: Deploy to ECS
        run: |
          aws ecs update-service \
            --cluster production \
            --service my-api \
            --force-new-deployment

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true