모노레포 GitHub Actions 재사용 워크플로 설계

# .github/workflows/ci.yml
name: ci

on:
  pull_request:
  push:
    branches: [main]

jobs:
  detect:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: diff
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            BASE="origin/${{ github.base_ref }}"
            git fetch origin ${{ github.base_ref }} --depth=1
          else
            BASE="${{ github.event.before }}"
          fi
          echo "base=$BASE" >> $GITHUB_OUTPUT
          echo "files<<EOF" >> $GITHUB_OUTPUT
          git diff --name-only "$BASE" "${{ github.sha }}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - id: set
        run: |
          FILES="${{ steps.diff.outputs.files }}"
          SERVICES=()

          echo "$FILES" | grep -q '^apps/api/' && SERVICES+=("api") || true
          echo "$FILES" | grep -q '^apps/web/' && SERVICES+=("web") || true
          echo "$FILES" | grep -q '^apps/worker/' && SERVICES+=("worker") || true

          if [ ${#SERVICES[@]} -eq 0 ]; then
            MATRIX='{"include":[]}'
          else
            JSON='{"include":['
            for SVC in "${SERVICES[@]}"; do
              JSON+="{\"service\":\"$SVC\"},"
            done
            JSON=${JSON%,}
            JSON+=']}'
            MATRIX="$JSON"
          fi

          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT

  build_test:
    needs: [detect]
    if: ${{ fromJson(needs.detect.outputs.matrix).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect.outputs.matrix) }}
    uses: ./.github/workflows/reusable-build-test.yml
    with:
      service: ${{ matrix.service }}

# .github/workflows/reusable-build-test.yml
name: reusable-build-test

on:
  workflow_call:
    inputs:
      service:
        required: true
        type: string
      workdir:
        required: false
        type: string
      node_version:
        required: false
        type: string
        default: '20'
    secrets:
      NPM_TOKEN:
        required: false

jobs:
  build_test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
        working-directory: ${{ inputs.workdir || format('apps/{0}', inputs.service) }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node_version }}
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            ${{ inputs.workdir || format('apps/{0}', inputs.service) }}/package-lock.json

      - name: Configure npm auth
        if: ${{ secrets.NPM_TOKEN != '' }}
        run: |
          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc

      - run: npm ci
      - run: npm run lint
      - run: npm test --if-present
      - run: npm run build

# .github/workflows/reusable-deploy.yml
name: reusable-deploy

on:
  workflow_call:
    inputs:
      service:
        required: true
        type: string
      environment:
        required: true
        type: string
      image_tag:
        required: true
        type: string
    secrets:
      AWS_REGION:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Deploy
        run: |
          echo "Deploying ${{ inputs.service }} with tag ${{ inputs.image_tag }} to ${{ inputs.environment }}"
          # 예: helm upgrade, kubectl set image 등

- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v3

- name: Build
  uses: docker/build-push-action@v6
  with:
    context: ${{ format('apps/{0}', inputs.service) }}
    file: ${{ format('apps/{0}/Dockerfile', inputs.service) }}
    push: false
    tags: ${{ format('local/{0}:{1}', inputs.service, github.sha) }}
    cache-from: type=gha
    cache-to: type=gha,mode=max

concurrency:
  group: ${{ format('ci-{0}-{1}', github.workflow, github.ref) }}
  cancel-in-progress: true

concurrency:
  group: ${{ format('deploy-{0}-{1}', inputs.service, inputs.environment) }}
  cancel-in-progress: false

# .github/workflows/release.yml
name: release

on:
  push:
    branches: [main]

jobs:
  detect:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: set
        run: |
          # 예시 단순화: main에서는 항상 전체 배포한다고 가정
          echo 'matrix={"include":[{"service":"api"},{"service":"web"}]}' >> $GITHUB_OUTPUT

  deploy:
    needs: [detect]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect.outputs.matrix) }}
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      service: ${{ matrix.service }}
      environment: production
      image_tag: ${{ github.sha }}
    secrets:
      AWS_REGION: ${{ secrets.AWS_REGION }}