develop -> main

.dockerignore

@@ -0,0 +1,8 @@
+**
+
+!Dockerfile
+!.dockerignore
+!build/
+!build/libs/
+!build/libs/KONECT_API.jar
+!opentelemetry-javaagent.jar

.github/workflows/checkstyle.yml

@@ -1,80 +1,80 @@
-name: Checkstyle
-
-on:
-  pull_request:
-    branches:
-      - main
-      - develop
-  push:
-    branches:
-      - main
-      - develop
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  checkstyle:
-    name: Code Style Check
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          token: ${{ secrets.SUBMODULE_TOKEN }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-
-      - name: Cache Gradle packages
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
-
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
-
-      - name: Run Checkstyle
-        run: ./gradlew checkstyleMain --no-daemon
-
-      - name: Upload Checkstyle Report
-        if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: checkstyle-report
-          path: |
-            build/reports/checkstyle/main.html
-            build/reports/checkstyle/main.xml
-          retention-days: 7
-
-      - name: Comment PR with Checkstyle Results
-        if: github.event_name == 'pull_request' && failure()
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-
-            let comment = '## ⚠️ Checkstyle 위반 사항 발견\n\n';
-            comment += 'Checkstyle 검사에서 코딩 컨벤션 위반이 발견되었습니다.\n\n';
-            comment += '### 📋 상세 리포트\n';
-            comment += '- [Main 소스 리포트 다운로드](../actions/runs/${{ github.run_id }})\n';
-
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: comment
-            });
+name: Checkstyle
+
+on:
+  pull_request:
+    branches:
+      - main
+      - develop
+  push:
+    branches:
+      - main
+      - develop
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  checkstyle:
+    name: Code Style Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          submodules: recursive
+          token: ${{ secrets.SUBMODULE_TOKEN }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Cache Gradle packages
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Run Checkstyle
+        run: ./gradlew checkstyleMain --no-daemon
+
+      - name: Upload Checkstyle Report
+        if: failure()
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        with:
+          name: checkstyle-report
+          path: |
+            build/reports/checkstyle/main.html
+            build/reports/checkstyle/main.xml
+          retention-days: 7
+
+      - name: Comment PR with Checkstyle Results
+        if: github.event_name == 'pull_request' && failure()
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+
+            let comment = '## ⚠️ Checkstyle 위반 사항 발견\n\n';
+            comment += 'Checkstyle 검사에서 코딩 컨벤션 위반이 발견되었습니다.\n\n';
+            comment += '### 📋 상세 리포트\n';
+            comment += '- [Main 소스 리포트 다운로드](../actions/runs/${{ github.run_id }})\n';
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });

.github/workflows/deploy-monitoring.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Transfer monitoring configs to server
-        uses: appleboy/scp-action@v0.1.7
+        uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
         with:
           host: ${{ secrets.SERVER_IP }}
           username: ${{ secrets.SERVER_USER }}
@@ -27,7 +27,7 @@ jobs:
           rm: false
 
       - name: Deploy monitoring stack
-        uses: appleboy/ssh-action@v0.1.8
+        uses: appleboy/ssh-action@v1.2.0
         env:
           WORK_DIR: ${{ secrets.PROD_WORK_DIR }}
           MONITORING_ENV: ${{ secrets.MONITORING_ENV }}

.github/workflows/deploy-prod.yml

@@ -11,16 +11,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '21'
           distribution: 'temurin'
 
       - name: Cache Gradle packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.gradle/caches
@@ -29,6 +29,23 @@ jobs:
           restore-keys: |
             gradle-${{ runner.os }}-
 
+      - name: Cache OpenTelemetry Java Agent
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/otel-java-agent
+          key: otel-agent-${{ runner.os }}-${{ vars.OTEL_JAVA_AGENT_VERSION }}-${{ vars.OTEL_JAVA_AGENT_SHA256 }}
+
+      - name: Prepare OpenTelemetry Agent
+        run: |
+          mkdir -p ~/.cache/otel-java-agent
+          if [ ! -f ~/.cache/otel-java-agent/opentelemetry-javaagent.jar ]; then
+            wget -O ~/.cache/otel-java-agent/opentelemetry-javaagent.jar \
+              "https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v${{ vars.OTEL_JAVA_AGENT_VERSION }}/opentelemetry-javaagent.jar"
+          fi
+          # Verify checksum
+          echo "${{ vars.OTEL_JAVA_AGENT_SHA256 }}  $HOME/.cache/otel-java-agent/opentelemetry-javaagent.jar" | sha256sum -c -
+          cp ~/.cache/otel-java-agent/opentelemetry-javaagent.jar .
+
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
@@ -38,46 +55,49 @@ jobs:
           source .env.example
           set +a
           unset JAVA_TOOL_OPTIONS
-          ./gradlew clean build -x test -Dspring.profiles.active=prod
+          ./gradlew bootJar -x test --build-cache -Dspring.profiles.active=prod
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: soundbar91/konect-prod
           tags: |
             type=raw,value=latest
             type=sha,prefix=sha-
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          build-args: |
+            OTEL_JAVA_AGENT_VERSION=${{ vars.OTEL_JAVA_AGENT_VERSION }}
 
       - name: Backup prod MySQL before deploy
-        uses: appleboy/ssh-action@v0.1.8
+        uses: appleboy/ssh-action@v1.2.0
         with:
           host: ${{ secrets.PROD_SERVER_IP }}
           username: ${{ secrets.PROD_SERVER_USER }}
           key: ${{ secrets.PROD_SERVER_SSH_KEY }}
           port: ${{ secrets.PROD_SERVER_PORT }}
           script: |
             set -euo pipefail
+            START_TIME=$(date +%s)
 
             WORK_DIR="${{ secrets.PROD_WORK_DIR }}"
             MYSQL_CONTAINER="mysql-prod"
@@ -96,13 +116,22 @@ jobs:
 
             find "$BACKUP_DIR" -type f -name '*.sql' -mtime +30 -delete
 
+            END_TIME=$(date +%s)
+            echo "Prod MySQL backup completed in $((END_TIME - START_TIME))s"
+
       - name: Deploy to prod server
-        uses: appleboy/ssh-action@v0.1.8
+        uses: appleboy/ssh-action@v1.2.0
         with:
           host: ${{ secrets.PROD_SERVER_IP }}
           username: ${{ secrets.PROD_SERVER_USER }}
           key: ${{ secrets.PROD_SERVER_SSH_KEY }}
           port: ${{ secrets.PROD_SERVER_PORT }}
           script: |
+            set -euo pipefail
+            START_TIME=$(date +%s)
+
             cd ${{ secrets.PROD_WORK_DIR }}
             ./deploy.sh
+
+            END_TIME=$(date +%s)
+            echo "Prod deploy.sh completed in $((END_TIME - START_TIME))s"