변수와 시크릿

name: enterprise-pipeline

triggers:
  push:
    branches: ["main", "develop"]
  change_request:
    branches: ["main"]

# ─────────────────────────────────────────
# Workflow 레벨 환경 변수
# 모든 Job/Step에서 $APP_NAME, $WORKSPACE_NAME 으로 접근 가능
# ─────────────────────────────────────────
env:
  APP_NAME: my-application
  WORKSPACE_NAME: "${{ vars.WORKSPACE_NAME }}"

jobs:
  # ─────────────────────────────────────────
  # 1. Setup — 환경 구성
  # ─────────────────────────────────────────
  setup:
    steps:
      - name: print-config
        run: |
          echo "App: $APP_NAME"
          echo "Workspace: $WORKSPACE_NAME"
          echo "Project: ${{ vars.PROJECT_NAME }}"

      - name: configure-build
        run: |
          echo "Build type: $BUILD_TYPE"
          echo "Version: $VERSION"
        # Step 레벨 env — vars에서 값을 가져와 환경 변수로 설정
        env:
          BUILD_TYPE: "${{ vars.BUILD_TYPE }}"
          VERSION: "${{ vars.VERSION }}"

  # ─────────────────────────────────────────
  # 2. Build — 빌드 (Job 레벨 env 활용)
  # ─────────────────────────────────────────
  build:
    needs: [setup]
    # Job 레벨 환경 변수 — 이 Job의 모든 Step에서 사용 가능
    env:
      NODE_ENV: production
      BUILD_DIR: "${{ vars.BUILD_DIRECTORY }}"
      API_BASE_URL: "${{ vars.API_BASE_URL }}"
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"

      - name: install-deps
        image: node:18
        run: |
          echo "Registry: $NPM_REGISTRY"
          npm ci
        env:
          # secrets로 민감한 토큰 전달
          NPM_REGISTRY: "${{ vars.NPM_REGISTRY }}"
          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"

      - name: build
        image: node:18
        run: |
          echo "Building to $BUILD_DIR"
          echo "API URL: $API_BASE_URL"
          npm run build
        env:
          # secrets로 API 키 전달
          API_KEY: "${{ secrets.API_KEY }}"

      - name: upload-artifacts
        run: |
          echo "Uploading to ${{ vars.ARTIFACT_STORAGE }}"
        env:
          # 스토리지 인증 정보
          STORAGE_URL: "${{ vars.ARTIFACT_STORAGE }}"
          ACCESS_KEY: "${{ secrets.STORAGE_ACCESS_KEY }}"
          SECRET_KEY: "${{ secrets.STORAGE_SECRET_KEY }}"

  # ─────────────────────────────────────────
  # 3. Test — 테스트 (DB 시크릿 활용)
  # ─────────────────────────────────────────
  test:
    needs: [build]
    env:
      TEST_ENV: "${{ vars.TEST_ENVIRONMENT }}"
      TEST_TIMEOUT: "${{ vars.TEST_TIMEOUT_SECONDS }}"
    steps:
      - name: unit-test
        image: node:18
        run: |
          echo "Test env: $TEST_ENV"
          echo "Timeout: $TEST_TIMEOUT"
          npm test
        env:
          # 테스트 DB 접속 정보 (secrets)
          TEST_DB_URL: "${{ secrets.TEST_DATABASE_URL }}"
          COVERAGE_TOKEN: "${{ secrets.COVERAGE_TOKEN }}"

      - name: integration-test
        image: node:18
        run: npm run test:integration
        env:
          API_ENDPOINT: "${{ vars.API_ENDPOINT }}"
          API_SECRET: "${{ secrets.API_SECRET }}"
          INTEGRATION_KEY: "${{ secrets.INTEGRATION_TEST_KEY }}"

      - name: generate-report
        run: echo "Report path: ${{ vars.REPORT_PATH }}"
        env:
          REPORT_PATH: "${{ vars.REPORT_PATH }}"
          REPORT_TOKEN: "${{ secrets.REPORT_UPLOAD_TOKEN }}"

  # ─────────────────────────────────────────
  # 4. Deploy — 배포 (클라우드 인증 시크릿)
  # ─────────────────────────────────────────
  deploy:
    needs: [build, test]
    if: "collabops.ref == 'refs/heads/main' && collabops.event_name == 'push'"
    env:
      DEPLOY_ENV: "${{ vars.DEPLOYMENT_ENVIRONMENT }}"
      DEPLOY_REGION: "${{ vars.DEPLOYMENT_REGION }}"
    steps:
      - name: authenticate
        run: echo "Authenticating to ${{ vars.CLOUD_PROVIDER }}"
        env:
          CLOUD_PROVIDER: "${{ vars.CLOUD_PROVIDER }}"
          CLOUD_ACCESS_KEY: "${{ secrets.CLOUD_ACCESS_KEY }}"
          CLOUD_SECRET_KEY: "${{ secrets.CLOUD_SECRET_KEY }}"

      - name: deploy-staging
        run: echo "Deploying to staging: ${{ vars.STAGING_URL }}"
        env:
          STAGING_URL: "${{ vars.STAGING_URL }}"
          DEPLOY_KEY: "${{ secrets.DEPLOYMENT_KEY }}"

      - name: smoke-test
        run: echo "Smoke test: ${{ vars.SMOKE_TEST_ENDPOINT }}"
        env:
          SMOKE_TEST_ENDPOINT: "${{ vars.SMOKE_TEST_ENDPOINT }}"
          SMOKE_TEST_TOKEN: "${{ secrets.SMOKE_TEST_TOKEN }}"

      - name: deploy-production
        run: echo "Deploying to production: ${{ vars.PRODUCTION_URL }}"
        env:
          PRODUCTION_URL: "${{ vars.PRODUCTION_URL }}"
          PROD_ACCESS_KEY: "${{ secrets.PRODUCTION_ACCESS_KEY }}"
          PROD_SECRET_KEY: "${{ secrets.PRODUCTION_SECRET_KEY }}"

Step env  >  Job env  >  Workflow env
(최우선)                    (최하위)