merge: (#1041) prod-cd파일 수정 - #1042
Conversation
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughChanges프로덕션 CD 파이프라인
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant ECR
participant EC2
participant DockerCompose
GitHubActions->>GitHubActions: dms-main 테스트 실행
GitHubActions->>ECR: latest 및 github.sha 이미지 푸시
GitHubActions->>EC2: SSH 접속
EC2->>ECR: ECR 로그인
EC2->>DockerCompose: app 이미지 pull 및 재기동
DockerCompose-->>EC2: app healthy/running 상태 반환
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/prod-cd.yml (1)
92-94: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win
:latestpull은 방금 빌드한 이미지가 배포된다는 보장이 없습니다.
build-push가latest와${{ github.sha }}를 모두 푸시하지만, 배포는latest만 참조합니다. 배포가 연달아 실행되면 나중 파이프라인의latest가 먼저 반영될 수 있고, 어떤 커밋이 서버에 떠 있는지 추적·롤백도 어렵습니다. compose에 이미지 태그를 변수로 두고 커밋 SHA를 넘기는 방식을 권장합니다.♻️ 제안 방향
- docker compose pull app - docker compose up -d app + export APP_IMAGE_TAG="$IMAGE_TAG" # ssh SendEnv 또는 스크립트 인자로 전달 + docker compose pull app + docker compose up -d app서버
docker-compose.yml에서는image: ...:${APP_IMAGE_TAG:-latest}형태로 참조하도록 변경하고, 워크플로우에서github.sha를 전달하면 됩니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/prod-cd.yml around lines 92 - 94, Update the deployment flow around docker compose pull and docker compose up so it deploys the current github.sha image instead of relying on the mutable latest tag. Configure the app image reference in the server compose configuration to use APP_IMAGE_TAG with latest as its default, then pass github.sha through the workflow when pulling and starting the app container.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/prod-cd.yml:
- Around line 73-75: Update the production deployment workflow by adding a
concurrency configuration for the deploy workflow, using a stable group that
serializes runs and cancels or queues rapid push-triggered duplicates so only
one deployment executes against EC2 at a time.
- Around line 96-102: Update the deployment health-check loop around docker
compose ps -q app to fail immediately with a clear error and app logs when the
container ID is empty or its inspected status is exited/dead. Preserve the
existing healthy/running success path and timeout handling for other non-ready
states.
- Line 82: Replace the ssh-keyscan-based known_hosts setup with the pinned
EC2_HOST_KEY secret, writing that value to ~/.ssh/known_hosts for host
verification. Remove the silent stderr suppression and avoid rescanning the host
on each run, ensuring the step fails if the required key secret is unavailable
or invalid.
- Around line 77-86: Update the “Prepare SSH key” and “Deploy on EC2” steps to
pass EC2_SSH_KEY, EC2_HOST, EC2_USER, and any other referenced secrets through
the steps’ env configuration, then reference those environment variables inside
quoted shell commands instead of interpolating secrets directly in run scripts.
Preserve the existing SSH key setup and deployment behavior.
---
Nitpick comments:
In @.github/workflows/prod-cd.yml:
- Around line 92-94: Update the deployment flow around docker compose pull and
docker compose up so it deploys the current github.sha image instead of relying
on the mutable latest tag. Configure the app image reference in the server
compose configuration to use APP_IMAGE_TAG with latest as its default, then pass
github.sha through the workflow when pulling and starting the app container.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 81f9bf9d-63eb-4da9-b4fa-1d3ddf0456d4
📒 Files selected for processing (1)
.github/workflows/prod-cd.yml
📊 Main Service Coverage Report
|
1 participant
작업 내용 설명
주요 변경 사항
체크리스트
관련 이슈
Summary by CodeRabbit