feat: 환경별 프로파일 설정 및 배포 워크플로 개선

- 운영, 알파, 로컬 환경별 Spring 프로파일 설정 추가
- SPRING_PROFILES_ACTIVE 기본값을 'local'로 변경
- GitHub Actions 배포 워크플로 환경 변수 처리 방식 간소화
- Docker Hub 및 EC2 관련 Secrets 활용으로 보안 강화
- PEM 키 처리 로직 개선 및 유효성 검증 추가

Author: imeasy99

.github/workflows/deploy.yml

@@ -10,78 +10,80 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'alpha' }}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set Environment Variables
+      - name: Set image tag and Spring profile
         run: |
           if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
-            echo "ENV_TYPE=PROD" >> $GITHUB_ENV
-            echo "DOCKERHUB_USERNAME=${{ secrets.PROD_DOCKERHUB_USERNAME }}" >> $GITHUB_ENV
-            echo "DOCKERHUB_TOKEN=${{ secrets.PROD_DOCKERHUB_TOKEN }}" >> $GITHUB_ENV
-            echo "EC2_KEY=${{ secrets.PROD_EC2_KEY }}" >> $GITHUB_ENV
-            echo "EC2_HOST=${{ secrets.PROD_EC2_HOST }}" >> $GITHUB_ENV
-            echo "EC2_USER=${{ secrets.PROD_EC2_USER }}" >> $GITHUB_ENV
-            echo "ENV_FILE_CONTENT=${{ secrets.PROD_AUTH_BE_ENV_FILE }}" >> $GITHUB_ENV
             echo "IMAGE_TAG=latest" >> $GITHUB_ENV
             echo "SPRING_PROFILE=prod" >> $GITHUB_ENV
           else
-            echo "ENV_TYPE=ALPHA" >> $GITHUB_ENV
-            echo "DOCKERHUB_USERNAME=${{ secrets.ALPHA_DOCKERHUB_USERNAME }}" >> $GITHUB_ENV
-            echo "DOCKERHUB_TOKEN=${{ secrets.ALPHA_DOCKERHUB_TOKEN }}" >> $GITHUB_ENV
-            echo "EC2_KEY=${{ secrets.ALPHA_EC2_KEY }}" >> $GITHUB_ENV
-            echo "EC2_HOST=${{ secrets.ALPHA_EC2_HOST }}" >> $GITHUB_ENV
-            echo "EC2_USER=${{ secrets.ALPHA_EC2_USER }}" >> $GITHUB_ENV
-            echo "ENV_FILE_CONTENT=${{ secrets.ALPHA_AUTH_BE_ENV_FILE }}" >> $GITHUB_ENV
             echo "IMAGE_TAG=alpha" >> $GITHUB_ENV
             echo "SPRING_PROFILE=alpha" >> $GITHUB_ENV
           fi
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ env.DOCKERHUB_USERNAME }}
-          password: ${{ env.DOCKERHUB_TOKEN }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           tags: |
-            ${{ env.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
-            ${{ env.DOCKERHUB_USERNAME }}/auth-server:${{ github.sha }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/auth-server:${{ github.sha }}
 
       - name: Setup SSH
         run: |
+          set -euo pipefail
           mkdir -p ~/.ssh
-          echo "${{ env.EC2_KEY }}" | base64 --decode > ~/.ssh/ec2_key.pem
+          printf '%s' "${{ secrets.EC2_KEY }}" > /tmp/ec2_key_src
+          if [[ ! -s /tmp/ec2_key_src ]]; then
+            echo "::error::EC2_KEY secret is empty" >&2
+            exit 1
+          fi
+          if head -n 1 /tmp/ec2_key_src | grep -q '^[[:space:]]*-----BEGIN'; then
+            cp /tmp/ec2_key_src ~/.ssh/ec2_key.pem
+          else
+            tr -d '\n\r \t' < /tmp/ec2_key_src | base64 --decode > ~/.ssh/ec2_key.pem || {
+              echo "::error::EC2_KEY is not PEM and base64 decode failed" >&2
+              exit 1
+            }
+          fi
+          rm -f /tmp/ec2_key_src
           chmod 600 ~/.ssh/ec2_key.pem
 
-      - name: Create env dir and Copy env file to EC2
+      - name: Create env file and copy to EC2
         run: |
-          echo "${{ env.ENV_FILE_CONTENT }}" > auth-be.env
-          ssh -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem ${{ env.EC2_USER }}@${{ env.EC2_HOST }} 'mkdir -p ~/env'
-          scp -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem auth-be.env ${{ env.EC2_USER }}@${{ env.EC2_HOST }}:~/env/auth-be.env
+          printf '%s\n' "${{ secrets.AUTH_BE_ENV_FILE }}" > auth-be.env
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} 'mkdir -p ~/env'
+          scp -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem auth-be.env ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:~/env/auth-be.env
 
       - name: Deploy to EC2
         run: |
-          ssh -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem ${{ env.EC2_USER }}@${{ env.EC2_HOST }} "
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/ec2_key.pem ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} "
           set -e
-          echo '${{ env.DOCKERHUB_TOKEN }}' | docker login -u '${{ env.DOCKERHUB_USERNAME }}' --password-stdin
-          
-          docker pull ${{ env.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
-          
+          echo '${{ secrets.DOCKERHUB_TOKEN }}' | docker login -u '${{ secrets.DOCKERHUB_USERNAME }}' --password-stdin
+
+          docker pull ${{ secrets.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
+
           docker rm -f auth-be || true
-          
+
           docker run -d \
             --name auth-be \
             --restart unless-stopped \
             --network app-network \
             --env-file ~/env/auth-be.env \
             -e SPRING_PROFILES_ACTIVE=${{ env.SPRING_PROFILE }} \
-            ${{ env.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
-            
+            ${{ secrets.DOCKERHUB_USERNAME }}/auth-server:${{ env.IMAGE_TAG }}
+
           docker logout
           "

src/main/resources/application-alpha.yml

@@ -1,3 +1,4 @@
+# alpha — 알파 서버 (DDL update, 운영에 가까운 쿠키)
 spring:
   config:
     activate:

src/main/resources/application-local.yml

@@ -1,3 +1,4 @@
+# local — 로컬 개발 (DDL update, SQL 디버그, 쿠키 완화)
 spring:
   config:
     activate:

src/main/resources/application-prod.yml

@@ -1,3 +1,4 @@
+# prod — 운영 (RDS SSL, DDL validate, 쿠키 Strict)
 spring:
   config:
     activate:

src/main/resources/application.yml

@@ -10,7 +10,7 @@ spring:
       local: local, jwt, oauth
       alpha: alpha, jwt, oauth
       prod: prod, jwt, oauth
-    active: alpha
+    active: ${SPRING_PROFILES_ACTIVE:local}
 
   datasource:
     url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:authdb}