OCI 마이그레이션

.github/actions/update-image-tag/action.yml

@@ -0,0 +1,55 @@
+name: Update image tag in waffle-world-oci
+description: Updates the image tag in waffle-world-oci ArgoCD manifests
+
+inputs:
+  app-id:
+    required: true
+  private-key:
+    required: true
+  ocir-registry:
+    required: true
+  ocir-namespace:
+    required: true
+  ocir-repository:
+    required: true
+  image-tag:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Generate GitHub App token
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.private-key }}
+        owner: wafflestudio
+        repositories: waffle-world-oci
+
+    - name: Update image tag
+      shell: bash
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        OCIR_IMAGE: ${{ inputs.ocir-registry }}/${{ inputs.ocir-namespace }}/${{ inputs.ocir-repository }}
+        OCIR_REPOSITORY: ${{ inputs.ocir-repository }}
+        IMAGE_TAG: ${{ inputs.image-tag }}
+      run: |
+        REPO="wafflestudio/waffle-world-oci"
+        ENV_DIR=$(dirname "$OCIR_REPOSITORY")
+        DIR="argocd/$ENV_DIR"
+
+        for FILE_PATH in $(gh api "repos/$REPO/contents/$DIR" --jq '.[] | select(.name | endswith(".yaml") or endswith(".yml")) | .path'); do
+          CONTENT=$(gh api "repos/$REPO/contents/$FILE_PATH" --jq '.content' | base64 -d)
+          if echo "$CONTENT" | grep -q "image: $OCIR_IMAGE:"; then
+            UPDATED=$(echo "$CONTENT" | sed "s|image: $OCIR_IMAGE:[^ ]*|image: $OCIR_IMAGE:$IMAGE_TAG|g")
+            if [ "$CONTENT" != "$UPDATED" ]; then
+              SHA=$(gh api "repos/$REPO/contents/$FILE_PATH" --jq '.sha')
+              gh api --method PUT "repos/$REPO/contents/$FILE_PATH" \
+                -f message="build: update $OCIR_REPOSITORY to $IMAGE_TAG" \
+                -f content="$(echo "$UPDATED" | base64 -w 0)" \
+                -f sha="$SHA"
+              echo "Updated $FILE_PATH"
+            fi
+          fi
+        done

.github/workflows/_deploy-native.yml

@@ -3,17 +3,19 @@ name: deploy-native-template
 on:
   workflow_call:
     inputs:
-      ecr_repository:
+      ocir_repository:
         required: true
         type: string
       dockerfile:
         required: true
         type: string
         description: 'Dockerfile path (e.g., api/Dockerfile-native)'
     secrets:
-      AWS_ACCESS_KEY_ID:
+      OCI_AUTH_TOKEN:
         required: true
-      AWS_SECRET_ACCESS_KEY:
+      DEPLOYER_APP_ID:
+        required: true
+      DEPLOYER_APP_PRIVATE_KEY:
         required: true
 
 jobs:
@@ -24,43 +26,37 @@ jobs:
     env:
       IMAGE_TAG: ${{ github.run_number }}
       BUILD_NUMBER: ${{ github.run_number }}
-      ECR_REGISTRY: 405906814034.dkr.ecr.ap-northeast-2.amazonaws.com
-      ECR_REPOSITORY: ${{ inputs.ecr_repository }}
+      OCIR_REGISTRY: yny.ocir.io
+      OCIR_NAMESPACE: ax1dvc8vmenm
+      OCIR_REPOSITORY: ${{ inputs.ocir_repository }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ap-northeast-2
-
-      - name: Login to ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
+      - name: Login to OCIR
+        run: echo "${{ secrets.OCI_AUTH_TOKEN }}" | docker login $OCIR_REGISTRY -u ax1dvc8vmenm/members/snutt-deployer --password-stdin
 
-      - name: Get and save Auth Token for CodeArtifact
-        id: get-save-codeartifact-auth-token
-        run: |
-          aws codeartifact get-authorization-token \
-            --domain wafflestudio \
-            --domain-owner 405906814034 \
-            --query authorizationToken \
-            --region ap-northeast-1 \
-            --output text > .codeartifact_token
-
-      - name: Docker build, tag, and push image to ECR
+      - name: Docker build, tag, and push image to OCIR
         id: build-push-image
         run: |
+          echo "${{ github.token }}" > .github_token
           docker build \
-            --secret id=codeartifact_token,src=./.codeartifact_token \
+            --secret id=github_token,src=./.github_token \
             -f ${{ inputs.dockerfile }} \
-            -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG \
+            -t $OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG \
             . \
             --platform linux/arm64
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
+          rm -f .github_token
+          docker push $OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG
+          echo "image=$OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
 
+      - name: Update image tag in waffle-world-oci
+        uses: ./.github/actions/update-image-tag
+        with:
+          app-id: ${{ secrets.DEPLOYER_APP_ID }}
+          private-key: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
+          ocir-registry: ${{ env.OCIR_REGISTRY }}
+          ocir-namespace: ${{ env.OCIR_NAMESPACE }}
+          ocir-repository: ${{ env.OCIR_REPOSITORY }}
+          image-tag: ${{ env.IMAGE_TAG }}

.github/workflows/_deploy.yml

@@ -3,17 +3,19 @@ name: deploy-template
 on:
   workflow_call:
     inputs:
-      ecr_repository:
+      ocir_repository:
         required: true
         type: string
       dockerfile:
         required: true
         type: string
         description: 'Dockerfile path (e.g., api/Dockerfile)'
     secrets:
-      AWS_ACCESS_KEY_ID:
+      OCI_AUTH_TOKEN:
         required: true
-      AWS_SECRET_ACCESS_KEY:
+      DEPLOYER_APP_ID:
+        required: true
+      DEPLOYER_APP_PRIVATE_KEY:
         required: true
 
 jobs:
@@ -24,42 +26,37 @@ jobs:
     env:
       IMAGE_TAG: ${{ github.run_number }}
       BUILD_NUMBER: ${{ github.run_number }}
-      ECR_REGISTRY: 405906814034.dkr.ecr.ap-northeast-2.amazonaws.com
-      ECR_REPOSITORY: ${{ inputs.ecr_repository }}
+      OCIR_REGISTRY: yny.ocir.io
+      OCIR_NAMESPACE: ax1dvc8vmenm
+      OCIR_REPOSITORY: ${{ inputs.ocir_repository }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ap-northeast-2
-
-      - name: Login to ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
+      - name: Login to OCIR
+        run: echo "${{ secrets.OCI_AUTH_TOKEN }}" | docker login $OCIR_REGISTRY -u ax1dvc8vmenm/members/snutt-deployer --password-stdin
 
-      - name: Get and save Auth Token for CodeArtifact
-        id: get-save-codeartifact-auth-token
-        run: |
-          aws codeartifact get-authorization-token \
-            --domain wafflestudio \
-            --domain-owner 405906814034 \
-            --query authorizationToken \
-            --region ap-northeast-1 \
-            --output text > .codeartifact_token
-
-      - name: Docker build, tag, and push image to ECR
+      - name: Docker build, tag, and push image to OCIR
         id: build-push-image
         run: |
+          echo "${{ github.token }}" > .github_token
           docker build \
-            --secret id=codeartifact_token,src=./.codeartifact_token \
+            --secret id=github_token,src=./.github_token \
             -f ${{ inputs.dockerfile }} \
-            -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG \
+            -t $OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG \
             . \
             --platform linux/arm64
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
+          rm -f .github_token
+          docker push $OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG
+          echo "image=$OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+      - name: Update image tag in waffle-world-oci
+        uses: ./.github/actions/update-image-tag
+        with:
+          app-id: ${{ secrets.DEPLOYER_APP_ID }}
+          private-key: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
+          ocir-registry: ${{ env.OCIR_REGISTRY }}
+          ocir-namespace: ${{ env.OCIR_NAMESPACE }}
+          ocir-repository: ${{ env.OCIR_REPOSITORY }}
+          image-tag: ${{ env.IMAGE_TAG }}

.github/workflows/ci.yml

@@ -14,19 +14,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ap-northeast-2
-
       - name: Set up JDK 25
         uses: actions/setup-java@v4
         with:
           java-version: '25'
           distribution: 'temurin'
 
       - name: Run Tests
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           ./gradlew clean test -x processAot -x processTestAot

.github/workflows/deploy-api-dev-native.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy-native.yml
     with:
-      ecr_repository: snutt-dev/snutt-timetable
+      ocir_repository: snutt-dev/snutt-timetable
       dockerfile: api/Dockerfile-native
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-api-dev.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy.yml
     with:
-      ecr_repository: snutt-dev/snutt-timetable
+      ocir_repository: snutt-dev/snutt-timetable
       dockerfile: api/Dockerfile
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-api-prod-native.yml

@@ -8,11 +8,12 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy-native.yml
     with:
-      ecr_repository: snutt-prod/snutt-timetable
+      ocir_repository: snutt-prod/snutt-timetable
       dockerfile: api/Dockerfile-native
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
 
   notify:
     needs: deploy

.github/workflows/deploy-api-prod.yml

@@ -8,11 +8,12 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy.yml
     with:
-      ecr_repository: snutt-prod/snutt-timetable
+      ocir_repository: snutt-prod/snutt-timetable
       dockerfile: api/Dockerfile
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
 
   notify:
     needs: deploy

.github/workflows/deploy-batch-dev-native.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy-native.yml
     with:
-      ecr_repository: snutt-dev/snutt-timetable-batch
+      ocir_repository: snutt-dev/snutt-timetable-batch
       dockerfile: batch/Dockerfile-native
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-batch-dev.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy.yml
     with:
-      ecr_repository: snutt-dev/snutt-timetable-batch
+      ocir_repository: snutt-dev/snutt-timetable-batch
       dockerfile: batch/Dockerfile
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-batch-prod-native.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy-native.yml
     with:
-      ecr_repository: snutt-prod/snutt-timetable-batch
+      ocir_repository: snutt-prod/snutt-timetable-batch
       dockerfile: batch/Dockerfile-native
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-batch-prod.yml

@@ -8,8 +8,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy.yml
     with:
-      ecr_repository: snutt-prod/snutt-timetable-batch
+      ocir_repository: snutt-prod/snutt-timetable-batch
       dockerfile: batch/Dockerfile
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/deploy-manual-native.yml

@@ -3,8 +3,8 @@ name: Deploy Manual Native
 on:
   workflow_dispatch:
     inputs:
-      ecr_repository:
-        description: 'ECR 리포지토리 (예: snutt-dev/snutt-timetable)'
+      ocir_repository:
+        description: 'OCIR 리포지토리 (예: snutt-dev/snutt-timetable)'
         required: true
         type: string
       dockerfile:
@@ -16,9 +16,9 @@ jobs:
   deploy:
     uses: ./.github/workflows/_deploy-native.yml
     with:
-      ecr_repository: ${{ inputs.ecr_repository }}
+      ocir_repository: ${{ inputs.ocir_repository }}
       dockerfile: ${{ inputs.dockerfile }}
     secrets:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
+      OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
+      DEPLOYER_APP_ID: ${{ secrets.DEPLOYER_APP_ID }}
+      DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}