모노레포 파이프라인

name: monorepo-pipeline

triggers:
  push:
    branches: [main]

jobs:
  # ═══════════════════════════════════════
  # Phase 1: Source — 소스코드 체크아웃
  # ═══════════════════════════════════════

  # 메인 저장소 체크아웃
  source-main:
    phase: source
    steps:
      - name: checkout-main
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"

  # 공유 의존성 저장소 체크아웃 (서브모듈 등)
  source-deps:
    phase: source
    steps:
      - name: checkout-deps
        uses: "collabops/checkout@v2"
        with:
          repo-url: ${{ vars.DEPS_REPO_SSH_URL }}
          ssh-key: ${{ secrets.GIT_SSH_PRIVATE_KEY }}
          path: /workspace/deps

  # ═══════════════════════════════════════
  # Phase 2: Deps — 의존성 설치 (Frontend/Backend 병렬)
  # ═══════════════════════════════════════

  # Frontend 의존성 설치
  deps-frontend:
    phase: deps
    needs: [source-main, source-deps]    # 두 소스 모두 필요
    steps:
      - name: install-frontend-deps
        image: node:18
        run: |
          cd /workspace/source/frontend
          npm ci

  # Backend 의존성 설치
  deps-backend:
    phase: deps
    needs: [source-main, source-deps]    # Frontend와 병렬 실행
    steps:
      - name: install-backend-deps
        image: python:3.11
        run: |
          cd /workspace/source/backend
          pip install -r requirements.txt

  # ═══════════════════════════════════════
  # Phase 3: Build — 빌드 (Frontend/Backend 병렬)
  # ═══════════════════════════════════════

  build-frontend:
    phase: build
    needs: [deps-frontend]
    steps:
      - name: build-frontend
        image: node:18
        run: |
          cd /workspace/source/frontend
          npm run build

  build-backend:
    phase: build
    needs: [deps-backend]
    steps:
      - name: build-backend
        image: python:3.11
        run: |
          cd /workspace/source/backend
          python setup.py build

  # ═══════════════════════════════════════
  # Phase 4: Test — 테스트 + 보안 스캔 (모두 병렬)
  # ═══════════════════════════════════════

  # Frontend 단위 테스트
  test-frontend-unit:
    phase: test
    needs: [build-frontend]
    steps:
      - name: test-frontend
        image: node:18
        run: |
          cd /workspace/source/frontend
          npm test
        env:
          CI: "true"

  # Backend 단위 테스트
  test-backend-unit:
    phase: test
    needs: [build-backend]
    steps:
      - name: test-backend
        image: python:3.11
        run: |
          cd /workspace/source/backend
          pytest tests/unit/

  # E2E 테스트 — Frontend + Backend 모두 빌드 완료 후
  test-e2e:
    phase: test
    needs: [build-frontend, build-backend]
    steps:
      - name: e2e-tests
        image: node:18
        run: |
          cd /workspace/source
          npm run test:e2e

  # Frontend 보안 스캔
  security-frontend:
    phase: test
    needs: [build-frontend]
    steps:
      - name: security-scan-frontend
        image: node:18
        run: |
          cd /workspace/source/frontend
          npm audit --audit-level=high

  # Backend 보안 스캔
  security-backend:
    phase: test
    needs: [build-backend]
    steps:
      - name: security-scan-backend
        image: python:3.11
        run: |
          cd /workspace/source/backend
          pip audit

  # 컨테이너 이미지 보안 스캔
  security-container:
    phase: test
    needs: [build-frontend, build-backend]
    services:
      - docker
    steps:
      - name: container-scan
        image: docker:27.5-cli
        run: |
          docker build -t myapp:scan .
          # Trivy로 컨테이너 취약점 스캔
          trivy image myapp:scan

  # ═══════════════════════════════════════
  # Phase 5: Deploy — 스테이징 → 프로덕션 순차 배포
  # ═══════════════════════════════════════

  # 스테이징 배포 — 모든 테스트 + 보안 스캔 통과 후
  deploy-staging:
    phase: deploy
    needs:
      - test-frontend-unit
      - test-backend-unit
      - test-e2e
      - security-frontend
      - security-backend
      - security-container
    steps:
      - name: deploy-staging
        run: kubectl apply -f k8s/staging/

  # 프로덕션 배포 — 스테이징 검증 후
  deploy-production:
    phase: deploy
    needs: [deploy-staging]
    if: "collabops.ref == 'refs/heads/main' && collabops.event_name == 'push'"
    steps:
      - name: deploy-production
        run: kubectl apply -f k8s/production/

source-main ──┬── deps-frontend ── build-frontend ──┬── test-frontend-unit ──┐
              │                                     ├── security-frontend ───┤
              │                                     │                        │
source-deps ──┤                                     ├── test-e2e ────────────┤
              │                                     │                        ├── deploy-staging ── deploy-production
              │                                     ├── security-container ──┤
              │                                     │                        │
              └── deps-backend ─── build-backend ───┼── test-backend-unit ──┤
                                                    └── security-backend ───┘