Skip to content

feat :Github actions 자동 배포 기능 구현 #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pokerbearkr merged 1 commit into from
Jul 10, 2025
Merged

feat :Github actions 자동 배포 기능 구현 #165

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: CD

on:
push:
branches: [ "main", "dev" ]

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
Copy link

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

actions/checkout 버전을 최신 v4로 고정하세요

v3 태그는 2023-10 이후 더 이상 보안 업데이트를 받지 않습니다. GitHub 공식 권장 사항은 메이저 버전을 올리고 SHA-pin 혹은 특정 태그로 고정하여 재현성을 확보하는 것입니다.

다음과 같이 수정 제안드립니다.

-      - uses: actions/checkout@v3
+      # checkout action 최신 버전 고정
+      - uses: actions/checkout@v4

최신 릴리스 정보를 확인하기 위해 다음 웹 검색을 수행해주세요:

🌐 Web query:

What is the latest version and release date of GitHub actions/checkout? Has actions/checkout@v3 received any security updates after October 2023?

💡 Result:

The latest version of actions/checkout is v4, as evidenced by multiple references encouraging or demonstrating its usage in workflows as of early 2025[4][7][10].

Regarding the specific timeline:

  • The most recent explicit version reference found is v4.1.4 as mentioned in a February 2025 article[4], and several community threads suggest that v4 is now the standard.
  • actions/checkout@v3 is considered outdated because it relies on Node.js 16, which has been deprecated by GitHub[7].

Security updates for actions/checkout@v3 after October 2023:

  • There is no evidence in the search results of security updates to actions/checkout@v3 after October 2023.
  • Instead, workflows and maintainers are being advised to move to v4 due to both deprecation of Node.js 16 and the general direction of GitHub Actions maintenance[7].
  • The recommendation is clear: migrate to actions/checkout@v4 to avoid using older runtime environments and to benefit from ongoing security support[7].

Summary Table:

Version Latest Known Release Status Security Updates After Oct 2023
actions/checkout@v3 2022–2023 era (no newer) Deprecated, Node16 EOL[7] None Found
actions/checkout@v4 v4.1.4 (as of Feb 2025)[4] Latest, actively maintained Yes

Recommendation:
Update all workflows to use actions/checkout@v4 to ensure continued security and compatibility with GitHub Actions' current infrastructure[7][4].

Citations:

actions/checkout 액션을 v4로 업그레이드하세요

현재 .github/workflows/deploy.yml 11행에서
actions/checkout@v3을 사용 중인데, v3은 Node.js 16 기반으로 2023년 10월 이후 더 이상 보안 업데이트를 받지 않습니다.
GitHub 공식 권장사항에 따라 최신 메이저 버전인 v4(현재 v4.1.4)를 사용해 주세요.

수정 위치:

  • 파일: .github/workflows/deploy.yml
  • 라인: 11

제안 변경사항:

-      - uses: actions/checkout@v3
+      # checkout action 최신 버전(v4) 고정
+      - uses: actions/checkout@v4

이렇게 변경하면 지속적인 보안 패치와 호환성을 보장할 수 있습니다.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v3
# checkout action 최신 버전(v4) 고정
- uses: actions/checkout@v4
🧰 Tools
🪛 actionlint (1.7.7)

11-11: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents 
In .github/workflows/deploy.yml at line 11, update the GitHub Action version
from actions/checkout@v3 to actions/checkout@v4 to ensure ongoing security
updates and compatibility. Replace the version tag v3 with v4 in the uses field
on line 11.

- name: Deploy to EC2
uses: appleboy/ssh-action@master
with:
host: ${{ secrets.EC2_HOST }}
username: ubuntu
key: ${{ secrets.EC2_SSH_KEY }}
Comment on lines +13 to +17
Copy link

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

appleboy/ssh-action는 master 대신 버전 태그 또는 커밋 SHA로 고정하세요

master 브랜치에 의존하면 예기치 않은 breaking change 가 반영될 수 있습니다. 예:

-      - name: Deploy to EC2
-        uses: appleboy/ssh-action@master
+      - name: Deploy to EC2
+        uses: appleboy/[email protected]  # 예시: 실제 latest 안정 버전으로 교체

또한 known_hosts 또는 fingerprint 파라미터를 추가해 MITM 위험을 줄이시는 것을 권장드립니다.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: appleboy/ssh-action@master
with:
host: ${{ secrets.EC2_HOST }}
username: ubuntu
key: ${{ secrets.EC2_SSH_KEY }}
- name: Deploy to EC2
uses: appleboy/[email protected] # 예시: 실제 latest 안정 버전으로 교체
with:
host: ${{ secrets.EC2_HOST }}
username: ubuntu
key: ${{ secrets.EC2_SSH_KEY }}
🤖 Prompt for AI Agents 
In .github/workflows/deploy.yml around lines 13 to 17, replace the 'master'
reference for the appleboy/ssh-action with a specific version tag or commit SHA
to avoid unexpected breaking changes. Additionally, add the 'known_hosts' or
'fingerprint' parameter to the action configuration to reduce the risk of
man-in-the-middle attacks.

script: |
cd /home/ubuntu/backend
../deploy-backend.sh