Skip to content

[feat] EC2 프론트엔드 자동 배포 워크플로우 추가 #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mgYang53 merged 3 commits into from
Jan 31, 2026
Merged

[feat] EC2 프론트엔드 자동 배포 워크플로우 추가 #37

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bbd4de2
feat: GitHub Actions CD 배포 워크플로우 추가
dkqpeo Jan 30, 2026
3a7fd75
fix: 배포 트리거를 PR merge 시로 변경
dkqpeo Jan 30, 2026
c7393a5
fix: 원자적 배포 방식으로 변경
dkqpeo Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: Deploy Frontend

on:
pull_request:
branches: [main, dev]
types: [closed]

jobs:
deploy:
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: 10.28.0

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'pnpm'

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Build
run: pnpm build
env:
VITE_API_URL: ${{ secrets.VITE_API_URL }}
VITE_APP_URL: ${{ secrets.VITE_APP_URL }}

- name: Deploy to EC2
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.EC2_HOST }}
username: ${{ secrets.EC2_USER }}
key: ${{ secrets.EC2_SSH_KEY }}
source: "dist/*"
target: "/tmp/fe-deploy"
strip_components: 1

- name: Move files and set permissions
uses: appleboy/ssh-action@v1.2.0
with:
host: ${{ secrets.EC2_HOST }}
username: ${{ secrets.EC2_USER }}
key: ${{ secrets.EC2_SSH_KEY }}
Comment on lines +36 to +51
Copy link

@coderabbitai coderabbitai bot Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

appleboy scp-action ssh-action host key verification fingerprint known_hosts

💡 Result:

appleboy/ssh-action and appleboy/scp-action don’t use a known_hosts input; instead, they support SSH host key verification via a SHA256 host fingerprint (and proxy_fingerprint for jump hosts). [1][2]

How to do host key verification (recommended):

  1. Get the server’s host-key fingerprint (SHA256) on the server (example for ed25519):

    ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub | cut -d ' ' -f2

    (Use the matching host key type your server actually uses.) [1]

  2. Store that output as a GitHub Secret, e.g. SSH_FINGERPRINT.

  3. Pass it to the action:

    ssh-action

    - uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.HOST }}
    username: ${{ secrets.USERNAME }}
    key: ${{ secrets.KEY }}
    fingerprint: ${{ secrets.SSH_FINGERPRINT }}
    script: whoami

    [1]

    scp-action

    - uses: appleboy/scp-action@v1
  with:
    host: ${{ secrets.HOST }}
    username: ${{ secrets.USERNAME }}
    key: ${{ secrets.KEY }}
    fingerprint: ${{ secrets.SSH_FINGERPRINT }}
    source: dist/*
    target: /var/www/app

    [2]

If you specifically need known_hosts-style pinning, you’d typically do that with OpenSSH directly (e.g., ssh-keyscan to write ~/.ssh/known_hosts) and then run scp/ssh yourself—but for these appleboy/* actions, the built-in mechanism is the fingerprint input. [1][2]

SSH 호스트 키 검증 누락
문제: SCP/SSH 단계에서 호스트 키 검증이 설정되지 않았습니다.
영향: 중간자 공격(MITM)에 취약합니다.
대안: 서버의 SSH 호스트 키 지문(SHA256)을 구한 후 fingerprint 입력값으로 전달하세요.

- uses: appleboy/scp-action@v0.1.7
  with:
    host: ${{ secrets.EC2_HOST }}
    username: ${{ secrets.EC2_USER }}
    key: ${{ secrets.EC2_SSH_KEY }}
    fingerprint: ${{ secrets.SSH_HOST_FINGERPRINT }}
    source: "dist/*"
    target: "/tmp/fe-deploy"
    strip_components: 1

SSH 호스트 지문 확인: ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub | cut -d ' ' -f2

🤖 Prompt for AI Agents 
In @.github/workflows/deploy.yml around lines 34 - 49, Add SSH host key
verification to both the appleboy/scp-action@v0.1.7 and
appleboy/ssh-action@v1.2.0 steps by passing a fingerprint input (e.g.,
fingerprint: ${{ secrets.SSH_HOST_FINGERPRINT }}); compute the server's SSH host
key fingerprint (SHA256) and store it in the secret, then add the fingerprint
input to the scp step and the ssh step so the actions verify the host key before
connecting.

script: |
sudo mkdir -p /tmp/fe-deploy
sudo chown -R www-data:www-data /tmp/fe-deploy
sudo chmod -R 755 /tmp/fe-deploy
sudo rm -rf /var/www/dokdok-old
sudo mv /var/www/dokdok /var/www/dokdok-old
sudo mv /tmp/fe-deploy /var/www/dokdok
sudo rm -rf /var/www/dokdok-old
Comment on lines +52 to +59
Copy link

@coderabbitai coderabbitai bot Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

첫 배포 시 스크립트 실패 가능

문제: Line 57에서 /var/www/dokdok가 존재하지 않으면 mv 명령이 실패합니다.
영향: 첫 배포 또는 디렉터리가 없는 환경에서 전체 배포가 중단됩니다.
대안: || true 추가 또는 조건부 체크를 적용하세요.

🔧 수정 제안 
             sudo mkdir -p /tmp/fe-deploy
             sudo chown -R www-data:www-data /tmp/fe-deploy
             sudo chmod -R 755 /tmp/fe-deploy
             sudo rm -rf /var/www/dokdok-old
-            sudo mv /var/www/dokdok /var/www/dokdok-old
+            sudo mv /var/www/dokdok /var/www/dokdok-old || true
             sudo mv /tmp/fe-deploy /var/www/dokdok
             sudo rm -rf /var/www/dokdok-old
🤖 Prompt for AI Agents 
In @.github/workflows/deploy.yml around lines 52 - 59, The deploy script can
fail on first run because the sudo mv /var/www/dokdok /var/www/dokdok-old
command will error if /var/www/dokdok doesn't exist; modify the script to
tolerate a missing source by either appending a no-op-on-failure operator (i.e.,
make the mv resilient) or by wrapping that mv in a conditional existence check
that only runs the move when /var/www/dokdok is present, and keep the subsequent
sudo mv /tmp/fe-deploy /var/www/dokdok and cleanup steps unchanged so the rest
of the deployment proceeds.