[CD] CD 파이프라인 검증

.dockerignore

@@ -0,0 +1,31 @@
+# .dockerignore
+
+# Git 내부 파일
+.git
+.gitignore
+
+# IDE 설정 파일 (개발자 개인 설정)
+.idea/
+*.iml
+.vscode/
+
+# 로컬 그레들 빌드 결과물 (도커 내부에서 어차피 새로 빌드함)
+build/
+.gradle/
+out/
+
+# 로그 파일 및 로컬 환경 변수 (보안 및 용량 관리)
+*.log
+.env
+.env.*
+.DS_Store
+Thumbs.db
+
+# 문서 및 설명서 (서버 구동과 무관)
+*.md
+README.md
+
+# 도커 배포 전용 가이드 파일 (이미지 내부 진입 차단)
+Dockerfile
+docker-compose*.yml
+.dockerignore

.env.example

@@ -0,0 +1,14 @@
+# ===== PostgreSQL =====
+POSTGRES_DB=
+POSTGRES_USER=
+POSTGRES_PASSWORD=
+POSTGRES_PORT=
+
+# ===== Redis =====
+REDIS_PASSWORD=
+REDIS_PORT=
+
+# ===== OpenSearch =====
+OPENSEARCH_PORT=
+OPENSEARCH_PASSWORD=
+

.github/workflows/cd.yml

@@ -0,0 +1,144 @@
+# ============================================================
+# IPX-BE CD — 빌드 & EC2 배포
+# 흐름:   소스 빌드 → Docker 이미지 빌드 → GHCR 푸시 → EC2 배포 → 헬스체크
+# ============================================================
+
+name: CD — IPX-BE 빌드 & 배포
+
+on:
+  push:
+    branches: [ main ]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - '.github/workflows/ci.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: cd-ipx-be-production
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ghcr.io/ceos-ipx/patent-spring
+  CONTAINER_NAME: patent-spring
+
+jobs:
+  # =====================================================
+  # 1단계: 빌드 + 이미지 푸시
+  # =====================================================
+  build-and-push:
+    name: 빌드 & GHCR 푸시
+    runs-on: ubuntu-latest
+
+    outputs:
+      image-tag: ${{ steps.meta.outputs.sha }}
+
+    steps:
+      - name: 소스코드 체크아웃
+        uses: actions/checkout@v4
+
+      - name: JDK 21 설정 + Gradle 캐시
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          cache: 'gradle'
+
+      - name: Gradle 실행 권한 부여
+        run: chmod +x ./gradlew
+
+      - name: 애플리케이션 빌드
+        run: ./gradlew build -x test --no-daemon --parallel --build-cache
+
+      - name: Docker Buildx 설정
+        uses: docker/setup-buildx-action@v3
+
+      - name: GHCR 로그인
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: SHA 단축 태그 생성
+        id: meta
+        run: echo "sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+
+      - name: Docker 이미지 빌드 & 푸시
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:sha-${{ steps.meta.outputs.sha }}
+          cache-from: type=gha,scope=ipx-be
+          cache-to: type=gha,mode=max,scope=ipx-be
+
+  # =====================================================
+  # 2단계: EC2 배포 + 헬스체크
+  # =====================================================
+  deploy:
+    name: EC2 배포
+    needs: build-and-push
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: EC2에 SSH 배포
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ${{ secrets.EC2_USER }}
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script: |
+            set -e
+            cd /opt/ipx
+
+            echo "=== [1/4] 새 이미지 pull ==="
+            docker compose -f docker-compose.prod.yml --env-file .env.prod pull app-spring
+
+            echo "=== [2/4] 컨테이너 재생성 (의존 서비스는 건드리지 않음) ==="
+            docker compose -f docker-compose.prod.yml --env-file .env.prod up -d --no-deps app-spring
+
+            echo "=== [3/4] 헬스체크 대기 (최대 3분) ==="
+            HEALTHY=false
+            for i in $(seq 1 36); do
+              STATUS=$(docker inspect --format='{{.State.Health.Status}}' patent-spring 2>/dev/null || echo "missing")
+              echo "시도 $i/36 - 상태: $STATUS"
+              if [ "$STATUS" = "healthy" ]; then
+                HEALTHY=true
+                break
+              fi
+              sleep 5
+            done
+
+            if [ "$HEALTHY" != "true" ]; then
+              echo "❌ 헬스체크 실패"
+              echo "--- 컨테이너 로그 (마지막 100줄) ---"
+              docker logs patent-spring --tail 100
+              exit 1
+            fi
+            echo "✅ 헬스체크 통과"
+
+            echo "=== [4/4] 사용하지 않는 이미지 정리 ==="
+            docker image prune -f
+
+            echo "=== 배포 완료 ==="
+
+      - name: 배포 결과 요약
+        if: always()
+        run: |
+          if [ "${{ job.status }}" = "success" ]; then
+            echo "✅ IPX-BE Production 배포 성공"
+            echo "Image: ${{ env.IMAGE_NAME }}:sha-${{ needs.build-and-push.outputs.image-tag }}"
+          else
+            echo "❌ IPX-BE Production 배포 실패"
+            echo "수동 롤백 가이드:"
+            echo "  ssh로 EC2 접속 후, 이전 sha 이미지 태그로 임시 변경"
+            echo "  또는 git revert 후 main에 재푸시"
+          fi

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+# ============================================================
+# IPX-BE CI — PR 검증 파이프라인
+# ============================================================
+
+name: CI — IPX-BE 빌드 검증
+
+on:
+  pull_request:
+    branches: [ main, dev ]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - '.github/workflows/cd.yml'
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  build:
+    name: 빌드 검증
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 소스코드 체크아웃
+        uses: actions/checkout@v4
+
+      - name: JDK 21 설정 + Gradle 캐시
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          cache: 'gradle'
+
+      - name: Gradle 실행 권한 부여
+        run: chmod +x ./gradlew
+
+      - name: 빌드 검증 (테스트 생략, 추후 추가)
+        run: ./gradlew build -x test --no-daemon --parallel --build-cache
+
+      - name: 빌드 결과 확인
+        run: |
+          if [ -f build/libs/*-SNAPSHOT.jar ]; then
+            echo "✅ 빌드 성공"
+            ls -lh build/libs/
+          else
+            echo "❌ JAR 파일 생성 실패"
+            exit 1
+          fi

.gitignore

@@ -37,4 +37,5 @@ out/
 .vscode/
 
 ### environment files ###
-.env
+.env
+.env.prod

Dockerfile

@@ -0,0 +1,35 @@
+# ===== Build stage =====
+FROM eclipse-temurin:21-jdk-alpine AS builder
+WORKDIR /app
+
+COPY gradlew .
+COPY gradle gradle
+COPY build.gradle .
+COPY settings.gradle .
+
+RUN chmod +x ./gradlew && ./gradlew dependencies --no-daemon
+
+COPY src src
+
+RUN ./gradlew bootJar -x test --no-daemon
+
+# ===== Runtime stage ====
+FROM eclipse-temurin:21-jre-alpine
+
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
+WORKDIR /app
+
+COPY --from=builder /app/build/libs/*-SNAPSHOT.jar app.jar
+
+RUN chown appuser:appgroup app.jar
+
+USER appuser
+
+EXPOSE 8080
+
+ENTRYPOINT ["java", \
+    "-XX:+UseContainerSupport", \
+    "-XX:MaxRAMPercentage=75.0", \
+    "-Djava.security.egd=file:/dev/./urandom", \
+    "-jar", "app.jar"]

build.gradle

@@ -13,24 +13,44 @@ java {
 	}
 }
 
+jar {
+	enabled = false
+}
+
 repositories {
 	mavenCentral()
 }
 
 dependencies {
-	implementation 'org.springframework.boot:spring-boot-starter-validation'
-	implementation 'org.springframework.boot:spring-boot-starter-webmvc'
+	implementation 'org.springframework.boot:spring-boot-starter-web'
+	implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
+	implementation 'org.springframework.boot:spring-boot-starter-webflux'
 
-	compileOnly 'org.projectlombok:lombok'
+	runtimeOnly 'org.postgresql:postgresql'
+	implementation 'org.springframework.boot:spring-boot-starter-security'
+	implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
+	implementation 'io.jsonwebtoken:jjwt-api:0.12.6'
+	runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.12.6'
+
+	runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.12.6'
+	implementation 'org.springframework.boot:spring-boot-starter-mail'
+
+	implementation 'org.springframework.boot:spring-boot-starter-data-redis'
 
+	implementation 'org.springframework.boot:spring-boot-starter-validation'
+	compileOnly 'org.projectlombok:lombok'
 	annotationProcessor 'org.projectlombok:lombok'
+	implementation 'org.springframework.boot:spring-boot-starter-actuator'
+
+	implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3'
 
-	testImplementation 'org.springframework.boot:spring-boot-starter-data-jpa-test'
-	testImplementation 'org.springframework.boot:spring-boot-starter-validation-test'
-	testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
+	testImplementation 'org.springframework.boot:spring-boot-starter-test'
+	testImplementation 'org.springframework.security:spring-security-test'
 	testCompileOnly 'org.projectlombok:lombok'
-	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 	testAnnotationProcessor 'org.projectlombok:lombok'
+	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+
+	implementation 'com.fasterxml.jackson.core:jackson-databind'
 }
 
 tasks.named('test') {