[CHORE] 로컬 / 개발 환경 분리#33
Merged
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthrough이 PR은 Spring 프로필을 로컬/개발으로 분리해 설정 YAML을 리포지토리에 추가하고, Swagger에 다중 서버를 등록하며, CI에서 런타임으로 생성하던 Changes환경 프로필 분리 및 Swagger 다중 서버 설정
CI/CD 워크플로우 업데이트
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cd.yml (1)
60-60:⚠️ Potential issue | 🟠 Major
appleboy/ssh-action@master를 고정 버전(태그 또는 커밋 SHA)으로 핀닝하세요. (.github/workflows/cd.yml:60)
@master는 실행 시점마다 동작이 바뀔 수 있어 CD 공급망 리스크가 큽니다. 릴리스 태그나 가능하면 커밋 SHA로 고정하는 방식이 안전합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cd.yml at line 60, 현재 워크플로에서 "uses: appleboy/ssh-action@master"로 지정된 외부 액션이 태그 대신 브랜치로 참조되어 있어 공급망 리스크가 큽니다; "uses: appleboy/ssh-action@master"을 찾아 릴리스 태그나 커밋 SHA로 교체(예: appleboy/ssh-action@vX.Y.Z 또는 appleboy/ssh-action@<commit-sha>)하도록 업데이트하고, 변경 이유를 짧게 주석으로 남기며 필요하면 액션의 최신 안정 태그/커밋을 확인해 사용하세요.
🧹 Nitpick comments (1)
src/main/java/SeCause/SeCause_be/global/config/SwaggerConfig.java (1)
37-45: ⚡ Quick win운영 서버가 기본 선택되어 실수로 프로덕션에 요청을 보낼 위험
Swagger UI는 첫 번째로 추가된 서버를 기본값으로 사용합니다. 현재
prodServer가 먼저 추가되어 있어, 로컬 개발 시에도 Swagger UI에서 운영 서버가 기본 선택됩니다. 이로 인해 개발자가 실수로 운영 환경에 테스트 요청을 보낼 수 있습니다.로컬 서버를 먼저 추가하여 기본 선택되도록 하는 것이 안전합니다.
♻️ 제안하는 수정 사항
Server prodServer = new Server().url(prodServerUrl).description("운영 서버 (HTTPS)"); Server localServer = new Server().url("http://localhost:8080").description("로컬 테스트용 (HTTP)"); return new OpenAPI() - .addServersItem(prodServer) .addServersItem(localServer) + .addServersItem(prodServer) .info(info) .addSecurityItem(securityRequirement) .components(components);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/SeCause/SeCause_be/global/config/SwaggerConfig.java` around lines 37 - 45, In SwaggerConfig, the OpenAPI servers are added in an order that makes prodServer the default in Swagger UI; change the order so localServer is added before prodServer (i.e., call .addServersItem(localServer) then .addServersItem(prodServer>) or otherwise ensure localServer is the first entry) so that the local URL is selected by default and prevents accidental requests to the production server; update the OpenAPI builder that currently chains .addServersItem(prodServer).addServersItem(localServer) to add localServer first and keep the rest (.info, .addSecurityItem, .components) unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cd.yml:
- Line 75: Replace the immutable image tag usage: find occurrences of the
literal string "image: ${DOCKER_REPO}:latest" used in the deploy/pull steps and
change them to use the commit SHA tag produced by the build (e.g. "image:
${DOCKER_REPO}:${{ github.sha }}"); ensure every deployment reference (including
the repeated occurrences analogous to the one shown) matches the tag the
build/push step uses so the workflow pulls the exact image built for that
commit.
In `@src/main/resources/application-local.yml`:
- Around line 26-34: 애플리케이션이 로컬에서 ENV 미설정 시 jwt.secret이 null이 되어
JwtTokenProvider에서 jwtProperties.secret().getBytes() 호출 시 NPE가 발생하므로
application-local.yml의 jwt.secret 변수에 안전한 기본값을 추가해 로컬 개발에서도 동작하도록 수정하세요; 수정 대상은
yaml의 jwt.secret: ${JWT_SECRET} 항목이며 기본값은 로컬용 임시 비밀(예: 간단한 문자열)로 설정하고 배포 환경에서는
환경변수로 덮어쓰도록 유지하십시오.
---
Outside diff comments:
In @.github/workflows/cd.yml:
- Line 60: 현재 워크플로에서 "uses: appleboy/ssh-action@master"로 지정된 외부 액션이 태그 대신 브랜치로
참조되어 있어 공급망 리스크가 큽니다; "uses: appleboy/ssh-action@master"을 찾아 릴리스 태그나 커밋 SHA로
교체(예: appleboy/ssh-action@vX.Y.Z 또는 appleboy/ssh-action@<commit-sha>)하도록 업데이트하고,
변경 이유를 짧게 주석으로 남기며 필요하면 액션의 최신 안정 태그/커밋을 확인해 사용하세요.
---
Nitpick comments:
In `@src/main/java/SeCause/SeCause_be/global/config/SwaggerConfig.java`:
- Around line 37-45: In SwaggerConfig, the OpenAPI servers are added in an order
that makes prodServer the default in Swagger UI; change the order so localServer
is added before prodServer (i.e., call .addServersItem(localServer) then
.addServersItem(prodServer>) or otherwise ensure localServer is the first entry)
so that the local URL is selected by default and prevents accidental requests to
the production server; update the OpenAPI builder that currently chains
.addServersItem(prodServer).addServersItem(localServer) to add localServer first
and keep the rest (.info, .addSecurityItem, .components) unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 61e78c6a-31df-4cc3-bc1d-13c95110c950
📒 Files selected for processing (7)
.github/workflows/cd.yml.github/workflows/ci.yml.gitignoresrc/main/java/SeCause/SeCause_be/global/config/SwaggerConfig.javasrc/main/resources/application-dev.ymlsrc/main/resources/application-local.ymlsrc/main/resources/application.yml
💤 Files with no reviewable changes (2)
- .gitignore
- .github/workflows/ci.yml
| cat > docker-compose.yml <<EOF | ||
| services: | ||
| secause: | ||
| image: ${DOCKER_REPO}:latest |
There was a problem hiding this comment.
배포 이미지를 latest 대신 불변 태그로 고정하세요.
현재 배포가 ${DOCKER_REPO}:latest를 pull/up 하므로, 워크플로우가 연속 실행될 때 의도한 커밋이 아닌 이미지가 올라갈 수 있습니다. 빌드에서 이미 ${{ github.sha }}를 push하고 있으니 배포도 동일 SHA 태그를 사용해 원자적으로 맞추는 편이 안전합니다.
제안 변경안
- name: Deploy to server with Docker
uses: appleboy/ssh-action@master
env:
DOCKER_REPO: ${{ secrets.DOCKER_REPO }}
+ IMAGE_TAG: ${{ github.sha }}
with:
@@
- envs: DOCKER_REPO
+ envs: DOCKER_REPO,IMAGE_TAG
script: |
@@
cat > docker-compose.yml <<EOF
services:
secause:
- image: ${DOCKER_REPO}:latest
+ image: ${DOCKER_REPO}:${IMAGE_TAG}
container_name: secauseAlso applies to: 85-86
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cd.yml at line 75, Replace the immutable image tag usage:
find occurrences of the literal string "image: ${DOCKER_REPO}:latest" used in
the deploy/pull steps and change them to use the commit SHA tag produced by the
build (e.g. "image: ${DOCKER_REPO}:${{ github.sha }}"); ensure every deployment
reference (including the repeated occurrences analogous to the one shown)
matches the tag the build/push step uses so the workflow pulls the exact image
built for that commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
close #29
🔎 개요
로컬 환경과 개발 서버 환경을 분리하고, 배포 시 Docker 컨테이너가 서버의 환경변수 파일을 읽도록 CD 설정을 개선했습니다.
📝 작업 내용
local로 설정했습니다.application-local.yml,application-dev.yml기준으로 로컬/개발 서버 설정을 분리했습니다.secrets.APPLICATION으로 설정 파일을 생성하던 방식을 제거했습니다.docker-compose.yml을 생성하고/etc/secause/secause.env를env_file로 읽도록 수정했습니다.👀 변경 사항
환경 변수 설정을 주입하는 식으로 수정했으니, 변경사항에 맞게 로컬 설정 부탁드립니다
📸 스크린샷 (Optional)
✅ 체크리스트
💬 고민사항 및 리뷰 요구사항 (Optional)
Summary by CodeRabbit
신규 기능
기타