개발환경, 한눈에.

stages: [test, build, deploy]

workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH == "dev" && $CI_COMMIT_REF_PROTECTED == "true"'
    - when: never

variables:
  AWS_DEFAULT_REGION: ap-northeast-2
  AWS_ACCOUNT_ID: "242441135880"
  S3_BUCKET: gw-aidcmap-dev-web-242441135880
  APP_URL: https://devtest.aidcmap.ai
  FRONTEND_DIR: "."

frontend_build:
  stage: build
  image: node:24-alpine
  script:
    - cd "$FRONTEND_DIR"
    - npm ci
    - npm run build
    - test -f dist/index.html
  artifacts:
    paths:
      - ${FRONTEND_DIR}/dist/
    expire_in: 7 days

frontend_deploy:
  stage: deploy
  image: python:3.12-alpine
  variables:
    AWS_ROLE_ARN: $AWS_WEB_DEPLOY_ROLE_ARN
  id_tokens:
    AWS_OIDC_TOKEN:
      aud: sts.amazonaws.com
  before_script:
    - apk add --no-cache aws-cli
    - . ci/aws-oidc.sh
  needs:
    - job: frontend_build
      artifacts: true
  resource_group: aidcmap-dev-frontend
  environment:
    name: development/frontend
    url: https://devtest.aidcmap.ai
  when: manual
  allow_failure: false
  script:
    - |
      # Keep /guide/ intact. Do not add --delete.
      aws s3 sync "$FRONTEND_DIR/dist/" "s3://$S3_BUCKET/" \
        --exclude 'guide/*' --cache-control no-cache
      python3 ci/verify.py frontend

stages: [test, build, deploy]

workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH == "dev" && $CI_COMMIT_REF_PROTECTED == "true"'
    - when: never

variables:
  AWS_DEFAULT_REGION: ap-northeast-2
  AWS_ACCOUNT_ID: "242441135880"
  ECR_REPOSITORY: gw-aidcmap-dev-api
  APP_URL: https://devtest.aidcmap.ai
  BACKEND_DIR: "."

.aws_api:
  variables:
    AWS_ROLE_ARN: $AWS_API_DEPLOY_ROLE_ARN
  id_tokens:
    AWS_OIDC_TOKEN:
      aud: sts.amazonaws.com
  before_script:
    - apk add --no-cache aws-cli python3
    - . ci/aws-oidc.sh

backend_test:
  stage: test
  image: node:24-alpine
  script:
    - cd "$BACKEND_DIR"
    - npm ci
    - npm test

backend_image:
  extends: .aws_api
  stage: build
  # Pin both Docker images to your organization's approved matching version/digest.
  image: docker:cli
  services:
    - name: docker:dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: /certs
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: /certs/client
  needs: [backend_test]
  script:
    - |
      REGISTRY="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com"
      # A retry gets a new job ID, so immutable ECR tags never collide.
      IMAGE_TAG="$CI_COMMIT_SHORT_SHA-$CI_PIPELINE_ID-$CI_JOB_ID"
      AIDC_DOCKER_CONFIG="$(mktemp -d /tmp/aidcmap-docker.XXXXXX)"
      export DOCKER_CONFIG="$AIDC_DOCKER_CONFIG"
      aws ecr get-login-password \
        | docker login --username AWS --password-stdin "$REGISTRY"
      docker build --platform linux/amd64 \
        -t "$REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" "$BACKEND_DIR"
      docker push "$REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
      printf 'IMAGE_TAG=%s\n' "$IMAGE_TAG" > build.env
  artifacts:
    reports:
      dotenv: build.env
    expire_in: 7 days

backend_deploy:
  extends: .aws_api
  stage: deploy
  image: python:3.12-alpine
  needs:
    - job: backend_image
      artifacts: true
  resource_group: aidcmap-dev-backend
  environment:
    name: development/backend
    url: https://devtest.aidcmap.ai
  when: manual
  allow_failure: false
  script:
    - python3 ci/deploy-api.py "$IMAGE_TAG" --dry-run
    - python3 ci/deploy-api.py "$IMAGE_TAG"
    - python3 ci/verify.py backend

# Copy this file to .gitlab-ci.yml in a repository containing frontend/ and backend/.
# Keep the two included YAML examples and ci/ at the repository root.
include:
  - local: .gitlab-ci.frontend.yml
  - local: .gitlab-ci.backend.yml

variables:
  FRONTEND_DIR: frontend
  BACKEND_DIR: backend

# Both deployments are manual. For a coordinated change, deploy backend first,
# verify its health, then deploy frontend. Database migrations are a separate step.