GitHub Actions 재사용 워크플로우로 모노레포 CI 지옥 탈출

name: reusable-node-ci

on:
  workflow_call:
    inputs:
      workdir:
        description: "패키지 작업 디렉터리"
        required: true
        type: string
      node_version:
        required: false
        type: string
        default: "20"
      install_command:
        required: false
        type: string
        default: "pnpm install --frozen-lockfile"
      test_command:
        required: false
        type: string
        default: "pnpm test"
      build_command:
        required: false
        type: string
        default: "pnpm build"
      cache_key_prefix:
        required: false
        type: string
        default: "pnpm"
    secrets:
      NPM_TOKEN:
        required: false

jobs:
  ci:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ inputs.workdir }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 9

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node_version }}
          cache: "pnpm"

      - name: Configure npm auth (optional)
        if: ${{ secrets.NPM_TOKEN != '' }}
        run: |
          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Install
        run: ${{ inputs.install_command }}

      - name: Test
        run: ${{ inputs.test_command }}

      - name: Build
        run: ${{ inputs.build_command }}

name: ci

on:
  pull_request:
  push:
    branches: [ main ]

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: set-matrix
        shell: bash
        run: |
          BASE_SHA="${{ github.event.pull_request.base.sha }}"
          HEAD_SHA="${{ github.sha }}"

          if [ -z "$BASE_SHA" ]; then
            BASE_SHA="${{ github.sha }}^"
          fi

          CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" || true)

          # 예시: apps/* 또는 packages/* 변경만 대상
          WORKDIRS=$(echo "$CHANGED" \
            | awk -F/ '/^(apps|packages)\// {print $1"/"$2}' \
            | sort -u \
            | jq -R -s -c 'split("\n")[:-1]')

          if [ "$WORKDIRS" = "[]" ]; then
            echo 'matrix={"include":[]}' >> $GITHUB_OUTPUT
            exit 0
          fi

          MATRIX=$(echo "$WORKDIRS" \
            | jq -c '{"include": map({"workdir": .})}')

          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT

  package-ci:
    needs: detect-changes
    if: ${{ fromJson(needs.detect-changes.outputs.matrix).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }}

    uses: ./.github/workflows/reusable-node-ci.yml
    with:
      workdir: ${{ matrix.workdir }}
      node_version: "20"
      install_command: "pnpm install --frozen-lockfile"
      test_command: "pnpm test"
      build_command: "pnpm build"

if echo "$CHANGED" | grep -E '^(pnpm-lock.yaml|package.json|turbo.json|tsconfig.base.json)$' >/dev/null; then
  WORKDIRS=$(ls -d apps/* packages/* 2>/dev/null | jq -R -s -c 'split("\n")[:-1]')
fi

name: reusable-aws-oidc-deploy

on:
  workflow_call:
    inputs:
      aws_region:
        required: true
        type: string
      role_arn:
        required: true
        type: string
      deploy_command:
        required: true
        type: string
    secrets:
      # 필요 시 추가 시크릿
      EXTRA_SECRET:
        required: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ inputs.aws_region }}
          role-to-assume: ${{ inputs.role_arn }}

      - name: Deploy
        run: ${{ inputs.deploy_command }}

jobs:
  deploy-web:
    if: ${{ github.ref == 'refs/heads/main' }}
    uses: ./.github/workflows/reusable-aws-oidc-deploy.yml
    with:
      aws_region: "ap-northeast-2"
      role_arn: "arn:aws:iam::123456789012:role/gha-deploy"
      deploy_command: "./scripts/deploy-web.sh"