Skip to content

infra: Sprint 06 AWS 운영 인프라 구축 및 ECR digest 기반 자동 배포·롤백 구현 #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devikae wants to merge 24 commits into
base: main
Choose a base branch
from
Open

infra: Sprint 06 AWS 운영 인프라 구축 및 ECR digest 기반 자동 배포·롤백 구현 #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
ddee2fe
feat(deploy): EC2 및 RDS 배포 환경 구성 (Dockerfile, compose.prod.yml, 운영 스키마)
devikae Sep 11, 2026
4426b9c
feat(deploy): AWS Advanced JDBC Wrapper 기반 RDS IAM 무암호 인증 구성
devikae Sep 11, 2026
9cedf54
fix(frontend): Dockerfile npm ci에 --legacy-peer-deps 옵션 추가 (React 19 호환)
devikae Sep 11, 2026
287569e
docs(work): 3단계 수동 배포 및 Nginx 웹 접속 완료 내역 기록
devikae Sep 11, 2026
f068c15
feat(image): AWS S3 기반 비공개 이미지 업로드 및 권한 조회 API 구현
devikae Sep 11, 2026
dd9ea51
docs: S3 연동 및 프로덕션 실측 100% 완료 기록
devikae Sep 11, 2026
0d3c1ab
ci: GitHub Actions 기반 EC2 자동 배포 파이프라인(CI/CD) 구축 및 DTO 방어
devikae Sep 11, 2026
f630f34
docs(project): CI/CD 배포 파이프라인 구축 내역 갱신
devikae Sep 11, 2026
03b1819
ci: 백엔드 및 프론트엔드 선별적 배포 워크플로 분리
devikae Sep 11, 2026
0399445
ci: OIDC와 SSM 기반 배포로 전환
devikae Sep 13, 2026
58ab0bd
ci: GitHub OIDC 클레임 진단 추가
devikae Sep 13, 2026
64f4fdb
ci: SSM root 실행 시 Git 안전 디렉터리 등록
devikae Sep 13, 2026
0d1d312
ci: SSM Git 명령에 안전 디렉터리 옵션 전달
devikae Sep 13, 2026
af56bee
ci: OIDC 일회성 진단 단계 제거
devikae Sep 13, 2026
c001dec
docs: OIDC와 SSM 배포 검증 결과 기록
devikae Sep 13, 2026
173f203
fix: 운영 HTTPS origin CORS 허용
devikae Sep 13, 2026
16ee934
docs: 운영 CSRF CORS 검증 결과 기록
devikae Sep 13, 2026
12bfe1b
feat: 커뮤니티 UI 디자인 개편
devikae Sep 13, 2026
c4e307b
docs: 커뮤니티 UI 운영 배포 기록
devikae Sep 13, 2026
eaf7acc
ci: ECR digest 배포와 복구 흐름 추가
devikae Sep 16, 2026
bf94203
feat: 로그인 UI 배포 및 digest 롤백 지원
devikae Sep 16, 2026
6b1568c
docs: Sprint 06 배포와 복구 증거 정리
devikae Sep 16, 2026
3ecdc50
ci: stable 이미지 지정과 배포 장애 로그 보강
devikae Sep 16, 2026
66fcbaa
docs: stable 이미지와 배포 진단 검증 반영
devikae Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
169 changes: 169 additions & 0 deletions .github/workflows/deploy-backend.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,169 @@
name: Deploy Backend

on:
push:
branches: [ "main", "deploy/aws-ec2" ]
paths: [ 'backend/**', 'database/**', 'compose.prod.yml', 'scripts/deploy-ecr-service.sh', '.github/workflows/deploy-backend.yml' ]
workflow_dispatch:
inputs:
stable_tag:
description: 'release-<40자리 SHA>를 stable 태그로 이동'
required: false
type: string

concurrency:
group: ec2-production-deployment
cancel-in-progress: false

permissions:
contents: read
id-token: write

jobs:
ci-backend:
name: Backend CI (Spotless & Test)
runs-on: ubuntu-latest
if: github.event_name == 'push' || inputs.stable_tag == ''
services:
mysql:
image: mysql:8.0
env:
MYSQL_DATABASE: snowthing_test
MYSQL_USER: snowuser
MYSQL_PASSWORD: snowthing_pass_2026!
MYSQL_ROOT_PASSWORD: snowthing_root_2026!
ports: [ '3306:3306' ]
options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=5
env:
SNOWTHING_DB_USERNAME: snowuser
SNOWTHING_DB_PASSWORD: snowthing_pass_2026!
SNOWTHING_TEST_DB_URL: jdbc:mysql://localhost:3306/snowthing_test?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8&serverTimezone=Asia/Seoul
SNOWTHING_TEST_DB_USERNAME: snowuser
SNOWTHING_TEST_DB_PASSWORD: snowthing_pass_2026!
defaults:
run:
working-directory: ./backend
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: actions/setup-java@v6
with:
java-version: '21'
distribution: 'temurin'
- uses: gradle/actions/setup-gradle@v6
- run: chmod +x gradlew
- run: ./gradlew spotlessCheck
- run: ./gradlew test build -x spotlessCheck

deploy-backend:
name: Build, Push and Deploy Backend Digest
needs: [ci-backend]
runs-on: ubuntu-latest
timeout-minutes: 30
if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/deploy/aws-ec2') && (github.event_name == 'push' || inputs.stable_tag == '')
steps:
- uses: actions/checkout@v7
- name: Configure AWS credentials with OIDC
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}

- name: Log in to Amazon ECR
id: ecr
run: |
set -euo pipefail
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGISTRY="${ACCOUNT_ID}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com"
aws ecr get-login-password --region "${{ vars.AWS_REGION }}" | docker login --username AWS --password-stdin "$REGISTRY"
echo "registry=$REGISTRY" >> "$GITHUB_OUTPUT"

- name: Build or reuse commit image
id: image
env:
REGISTRY: ${{ steps.ecr.outputs.registry }}
REPOSITORY: ${{ vars.ECR_BACKEND_REPOSITORY }}
COMMIT_SHA: ${{ github.sha }}
run: |
set -euo pipefail
CANDIDATE_TAG="candidate-${COMMIT_SHA}"
RELEASE_TAG="release-${COMMIT_SHA}"
if aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$RELEASE_TAG" >/dev/null 2>&1; then
SOURCE_TAG="$RELEASE_TAG"; PROMOTE=false
elif aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$CANDIDATE_TAG" >/dev/null 2>&1; then
SOURCE_TAG="$CANDIDATE_TAG"; PROMOTE=true
else
docker build --tag "$REGISTRY/$REPOSITORY:$CANDIDATE_TAG" ./backend
docker push "$REGISTRY/$REPOSITORY:$CANDIDATE_TAG"
SOURCE_TAG="$CANDIDATE_TAG"; PROMOTE=true
fi
DIGEST=$(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'imageDetails[0].imageDigest' --output text)
echo "image_uri=$REGISTRY/$REPOSITORY@$DIGEST" >> "$GITHUB_OUTPUT"
echo "source_tag=$SOURCE_TAG" >> "$GITHUB_OUTPUT"
echo "promote=$PROMOTE" >> "$GITHUB_OUTPUT"

- name: Deploy backend digest via SSM
env:
INSTANCE_ID: ${{ vars.EC2_INSTANCE_ID }}
DEPLOY_BRANCH: ${{ github.ref_name }}
IMAGE_URI: ${{ steps.image.outputs.image_uri }}
AWS_REGION: ${{ vars.AWS_REGION }}
run: |
set -euo pipefail
PARAMETERS=$(jq -n --arg branch "$DEPLOY_BRANCH" --arg image "$IMAGE_URI" --arg region "$AWS_REGION" '{commands: [
"set -e", "cd /home/ubuntu/snowthing",
"git -c safe.directory=/home/ubuntu/snowthing fetch origin \"" + $branch + "\"",
"git -c safe.directory=/home/ubuntu/snowthing reset --hard \"origin/" + $branch + "\"",

@yyy9942 yyy9942 Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

여기서는 이미지를 github.sha 기준으로 만들었는데, EC2에서는 다시 현재 브랜치의 HEAD를 받아오고 있네요.

워크플로가 대기하는 사이 새 커밋이 들어오면 검증한 이미지와 실제 실행하는 compose.prod.yml/배포 스크립트의 버전이 달라질 수 있습니다. digest를 고정한 의미가 여기서 깨질 수 있어요.

브랜치명이 아니라 ${{ github.sha }}를 SSM으로 넘기고, EC2에서도 그 SHA를 명시적으로 fetch/reset해서 이미지와 배포 설정을 하나의 커밋 단위로 맞춰주세요. 프론트 워크플로도 같은 부분을 같이 확인해보면 좋겠습니다.

"chmod +x scripts/deploy-ecr-service.sh",
"scripts/deploy-ecr-service.sh backend \"" + $image + "\" \"" + $region + "\""
]}')
COMMAND_ID=$(aws ssm send-command --instance-ids "$INSTANCE_ID" --document-name AWS-RunShellScript --timeout-seconds 900 --parameters "$PARAMETERS" --comment "Deploy backend digest from ${GITHUB_REPOSITORY}@${GITHUB_SHA}" --query 'Command.CommandId' --output text)
echo "SSM command ID: $COMMAND_ID"
STATUS=Pending
for _ in $(seq 1 180); do
STATUS=$(aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
case "$STATUS" in Success|Cancelled|TimedOut|Failed|Cancelling) break ;; esac
sleep 5
done
aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query '{Status:Status,StandardOutput:StandardOutputContent,StandardError:StandardErrorContent}'
test "$STATUS" = Success

- name: Promote successful image to release
if: steps.image.outputs.promote == 'true'
env:
REPOSITORY: ${{ vars.ECR_BACKEND_REPOSITORY }}
SOURCE_TAG: ${{ steps.image.outputs.source_tag }}
RELEASE_TAG: release-${{ github.sha }}
run: |
set -euo pipefail
MANIFEST=$(aws ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'images[0].imageManifest' --output text)
aws ecr put-image --repository-name "$REPOSITORY" --image-tag "$RELEASE_TAG" --image-manifest "$MANIFEST" >/dev/null
aws ecr batch-delete-image --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" >/dev/null

mark-stable-backend:
name: Mark Backend Release as Stable
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch' && inputs.stable_tag != ''
steps:
- name: Configure AWS credentials with OIDC
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
- name: Move all release tags on the digest to one stable tag
env:
REPOSITORY: ${{ vars.ECR_BACKEND_REPOSITORY }}
SOURCE_TAG: ${{ inputs.stable_tag }}
run: |
set -euo pipefail
[[ "$SOURCE_TAG" =~ ^release-[0-9a-f]{40}$ ]]
DIGEST=$(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'imageDetails[0].imageDigest' --output text)
MANIFEST=$(aws ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageDigest="$DIGEST" --query 'images[0].imageManifest' --output text)
STABLE_TAG="stable-${SOURCE_TAG#release-}"
aws ecr put-image --repository-name "$REPOSITORY" --image-tag "$STABLE_TAG" --image-manifest "$MANIFEST" >/dev/null
mapfile -t RELEASE_TAGS < <(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageDigest="$DIGEST" --query 'imageDetails[0].imageTags[?starts_with(@, `release-`)]' --output text | tr '\t' '\n')
for tag in "${RELEASE_TAGS[@]}"; do
[[ -n "$tag" ]] && aws ecr batch-delete-image --repository-name "$REPOSITORY" --image-ids imageTag="$tag" >/dev/null
done
echo "$STABLE_TAG -> $DIGEST"
205 changes: 205 additions & 0 deletions .github/workflows/deploy-frontend.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,205 @@
name: Deploy Frontend

on:
push:
branches: [ "main", "deploy/aws-ec2" ]
paths: [ 'frontend/**', 'compose.prod.yml', 'scripts/deploy-ecr-service.sh', '.github/workflows/deploy-frontend.yml' ]
workflow_dispatch:
inputs:
rollback_tag:
description: '비워 두면 현재 커밋 배포, 입력하면 release-<40자리 SHA> 또는 stable-<40자리 SHA>로 복구'
required: false
type: string
stable_tag:
description: 'release-<40자리 SHA>를 stable 태그로 이동'
required: false
type: string

concurrency:
group: ec2-production-deployment
cancel-in-progress: false

permissions:
contents: read
id-token: write

jobs:
ci-frontend:
name: Frontend CI (Build Verification)
if: github.event_name == 'push' || (inputs.rollback_tag == '' && inputs.stable_tag == '')
runs-on: ubuntu-latest
defaults:
run:
working-directory: ./frontend
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 20
cache: npm
cache-dependency-path: frontend/package-lock.json
- run: npm ci --legacy-peer-deps
- run: npm run build

deploy-frontend:
name: Build, Push and Deploy Frontend Digest
needs: [ci-frontend]
runs-on: ubuntu-latest
timeout-minutes: 30
if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/deploy/aws-ec2') && (github.event_name == 'push' || (inputs.rollback_tag == '' && inputs.stable_tag == ''))
steps:
- uses: actions/checkout@v7
- name: Configure AWS credentials with OIDC
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}

- name: Log in to Amazon ECR
id: ecr
run: |
set -euo pipefail
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGISTRY="${ACCOUNT_ID}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com"
aws ecr get-login-password --region "${{ vars.AWS_REGION }}" | docker login --username AWS --password-stdin "$REGISTRY"
echo "registry=$REGISTRY" >> "$GITHUB_OUTPUT"

- name: Build or reuse commit image
id: image
env:
REGISTRY: ${{ steps.ecr.outputs.registry }}
REPOSITORY: ${{ vars.ECR_FRONTEND_REPOSITORY }}
COMMIT_SHA: ${{ github.sha }}
API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
run: |
set -euo pipefail
CANDIDATE_TAG="candidate-${COMMIT_SHA}"
RELEASE_TAG="release-${COMMIT_SHA}"
if aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$RELEASE_TAG" >/dev/null 2>&1; then
SOURCE_TAG="$RELEASE_TAG"; PROMOTE=false
elif aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$CANDIDATE_TAG" >/dev/null 2>&1; then
SOURCE_TAG="$CANDIDATE_TAG"; PROMOTE=true
else
docker build --build-arg NEXT_PUBLIC_API_BASE_URL="$API_BASE_URL" --tag "$REGISTRY/$REPOSITORY:$CANDIDATE_TAG" ./frontend
docker push "$REGISTRY/$REPOSITORY:$CANDIDATE_TAG"
SOURCE_TAG="$CANDIDATE_TAG"; PROMOTE=true
fi
DIGEST=$(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'imageDetails[0].imageDigest' --output text)
echo "image_uri=$REGISTRY/$REPOSITORY@$DIGEST" >> "$GITHUB_OUTPUT"
echo "source_tag=$SOURCE_TAG" >> "$GITHUB_OUTPUT"
echo "promote=$PROMOTE" >> "$GITHUB_OUTPUT"

- name: Deploy frontend digest via SSM
env:
INSTANCE_ID: ${{ vars.EC2_INSTANCE_ID }}
DEPLOY_BRANCH: ${{ github.ref_name }}
IMAGE_URI: ${{ steps.image.outputs.image_uri }}
AWS_REGION: ${{ vars.AWS_REGION }}
run: |
set -euo pipefail
PARAMETERS=$(jq -n --arg branch "$DEPLOY_BRANCH" --arg image "$IMAGE_URI" --arg region "$AWS_REGION" '{commands: [
"set -e", "cd /home/ubuntu/snowthing",
"git -c safe.directory=/home/ubuntu/snowthing fetch origin \"" + $branch + "\"",
"git -c safe.directory=/home/ubuntu/snowthing reset --hard \"origin/" + $branch + "\"",
"chmod +x scripts/deploy-ecr-service.sh",
"scripts/deploy-ecr-service.sh frontend \"" + $image + "\" \"" + $region + "\""
]}')
COMMAND_ID=$(aws ssm send-command --instance-ids "$INSTANCE_ID" --document-name AWS-RunShellScript --timeout-seconds 900 --parameters "$PARAMETERS" --comment "Deploy frontend digest from ${GITHUB_REPOSITORY}@${GITHUB_SHA}" --query 'Command.CommandId' --output text)
echo "SSM command ID: $COMMAND_ID"
STATUS=Pending
for _ in $(seq 1 180); do
STATUS=$(aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
case "$STATUS" in Success|Cancelled|TimedOut|Failed|Cancelling) break ;; esac
sleep 5
done
aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query '{Status:Status,StandardOutput:StandardOutputContent,StandardError:StandardErrorContent}'
test "$STATUS" = Success

- name: Promote successful image to release
if: steps.image.outputs.promote == 'true'
env:
REPOSITORY: ${{ vars.ECR_FRONTEND_REPOSITORY }}
SOURCE_TAG: ${{ steps.image.outputs.source_tag }}
RELEASE_TAG: release-${{ github.sha }}
run: |
set -euo pipefail
MANIFEST=$(aws ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'images[0].imageManifest' --output text)
aws ecr put-image --repository-name "$REPOSITORY" --image-tag "$RELEASE_TAG" --image-manifest "$MANIFEST" >/dev/null
aws ecr batch-delete-image --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" >/dev/null

rollback-frontend:
name: Roll Back Frontend to Selected Digest
runs-on: ubuntu-latest
timeout-minutes: 20
if: github.event_name == 'workflow_dispatch' && inputs.rollback_tag != ''
steps:
- name: Validate rollback tag
env:
ROLLBACK_TAG: ${{ inputs.rollback_tag }}
run: |
set -euo pipefail
[[ "$ROLLBACK_TAG" =~ ^(release|stable)-[0-9a-f]{40}$ ]]

- name: Configure AWS credentials with OIDC
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}

- name: Resolve rollback digest and deploy via SSM
env:
INSTANCE_ID: ${{ vars.EC2_INSTANCE_ID }}
DEPLOY_BRANCH: ${{ github.ref_name }}
REPOSITORY: ${{ vars.ECR_FRONTEND_REPOSITORY }}
AWS_REGION: ${{ vars.AWS_REGION }}
ROLLBACK_TAG: ${{ inputs.rollback_tag }}
run: |
set -euo pipefail
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGISTRY="${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
DIGEST=$(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$ROLLBACK_TAG" --query 'imageDetails[0].imageDigest' --output text)
IMAGE_URI="$REGISTRY/$REPOSITORY@$DIGEST"
PARAMETERS=$(jq -n --arg branch "$DEPLOY_BRANCH" --arg image "$IMAGE_URI" --arg region "$AWS_REGION" '{commands: [
"set -e", "cd /home/ubuntu/snowthing",
"git -c safe.directory=/home/ubuntu/snowthing fetch origin \"" + $branch + "\"",
"git -c safe.directory=/home/ubuntu/snowthing reset --hard \"origin/" + $branch + "\"",
"chmod +x scripts/deploy-ecr-service.sh",
"scripts/deploy-ecr-service.sh frontend \"" + $image + "\" \"" + $region + "\""
]}')
COMMAND_ID=$(aws ssm send-command --instance-ids "$INSTANCE_ID" --document-name AWS-RunShellScript --timeout-seconds 900 --parameters "$PARAMETERS" --comment "Rollback frontend to $ROLLBACK_TAG" --query 'Command.CommandId' --output text)
echo "SSM command ID: $COMMAND_ID"
STATUS=Pending
for _ in $(seq 1 180); do
STATUS=$(aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
case "$STATUS" in Success|Cancelled|TimedOut|Failed|Cancelling) break ;; esac
sleep 5
done
aws ssm get-command-invocation --command-id "$COMMAND_ID" --instance-id "$INSTANCE_ID" --query '{Status:Status,StandardOutput:StandardOutputContent,StandardError:StandardErrorContent}'
test "$STATUS" = Success

mark-stable-frontend:
name: Mark Frontend Release as Stable
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch' && inputs.stable_tag != ''
steps:
- name: Configure AWS credentials with OIDC
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
- name: Move all release tags on the digest to one stable tag
env:
REPOSITORY: ${{ vars.ECR_FRONTEND_REPOSITORY }}
SOURCE_TAG: ${{ inputs.stable_tag }}
run: |
set -euo pipefail
[[ "$SOURCE_TAG" =~ ^release-[0-9a-f]{40}$ ]]
DIGEST=$(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageTag="$SOURCE_TAG" --query 'imageDetails[0].imageDigest' --output text)
MANIFEST=$(aws ecr batch-get-image --repository-name "$REPOSITORY" --image-ids imageDigest="$DIGEST" --query 'images[0].imageManifest' --output text)
STABLE_TAG="stable-${SOURCE_TAG#release-}"
aws ecr put-image --repository-name "$REPOSITORY" --image-tag "$STABLE_TAG" --image-manifest "$MANIFEST" >/dev/null
mapfile -t RELEASE_TAGS < <(aws ecr describe-images --repository-name "$REPOSITORY" --image-ids imageDigest="$DIGEST" --query 'imageDetails[0].imageTags[?starts_with(@, `release-`)]' --output text | tr '\t' '\n')
for tag in "${RELEASE_TAGS[@]}"; do
[[ -n "$tag" ]] && aws ecr batch-delete-image --repository-name "$REPOSITORY" --image-ids imageTag="$tag" >/dev/null
done
echo "$STABLE_TAG -> $DIGEST"
2 changes: 1 addition & 1 deletion .github/workflows/gemini-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:

steps:
- name: Checkout Repository
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Run Gemini Review via REST API
env:
Expand Down
Loading
Loading