Google Drive OAuth 중앙 수합형으로 전환

.github/workflows/deploy-gongju-moon-observation-cloudflare.yml

@@ -0,0 +1,129 @@
+name: Deploy Gongju Moon Observation to Cloudflare
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gongju-moon-observation-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: production
+    defaults:
+      run:
+        working-directory: gongju-moon-observation
+    env:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_CUSTOM_DOMAIN: ${{ vars.CLOUDFLARE_CUSTOM_DOMAIN }}
+      SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
+      TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}
+      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: gongju-moon-observation/package-lock.json
+      - run: npm ci
+      - run: npm run lint
+      - name: Validate production configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          required=(
+            CLOUDFLARE_ACCOUNT_ID
+            CLOUDFLARE_API_TOKEN
+            CLOUDFLARE_CUSTOM_DOMAIN
+            SESSION_SECRET
+            TOKEN_ENCRYPTION_KEY
+            GOOGLE_CLIENT_ID
+            GOOGLE_CLIENT_SECRET
+          )
+          for name in "${required[@]}"; do
+            if [[ -z "${!name:-}" ]]; then
+              echo "필수 production secret/variable ${name}가 없습니다." >&2
+              exit 78
+            fi
+          done
+          if [[ ${#SESSION_SECRET} -lt 32 || ${#TOKEN_ENCRYPTION_KEY} -lt 32 ]]; then
+            echo "SESSION_SECRET과 TOKEN_ENCRYPTION_KEY는 각각 32자 이상이어야 합니다." >&2
+            exit 78
+          fi
+          node scripts/configure-cloudflare-deploy.mjs
+      - name: Build and verify direct Cloudflare target
+        env:
+          CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH: wrangler.cloudflare.deploy.json
+          NEXT_PUBLIC_SITE_ORIGIN: https://${{ vars.CLOUDFLARE_CUSTOM_DOMAIN }}
+        run: |
+          npm run build
+          node --test tests/cloudflare-deploy.test.mjs
+      - name: Create ephemeral Wrangler secrets file
+        shell: bash
+        run: |
+          node --input-type=module <<'NODE'
+          import { writeFile } from "node:fs/promises";
+          const values = {
+            SESSION_SECRET: process.env.SESSION_SECRET,
+            TOKEN_ENCRYPTION_KEY: process.env.TOKEN_ENCRYPTION_KEY,
+            GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID,
+            GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,
+            PUBLIC_ORIGIN: `https://${process.env.CLOUDFLARE_CUSTOM_DOMAIN}`,
+          };
+          await writeFile(process.env.RUNNER_TEMP + "/gongju-worker-secrets.json", JSON.stringify(values));
+          NODE
+      - name: Deploy Worker and provision D1
+        shell: bash
+        run: |
+          npx wrangler deploy \
+            --config dist/server/wrangler.json \
+            --secrets-file "$RUNNER_TEMP/gongju-worker-secrets.json" \
+            --message "${GITHUB_SHA} central drive.file release"
+      - name: Apply D1 migrations
+        shell: bash
+        run: |
+          npx wrangler d1 migrations apply DB \
+            --remote \
+            --config dist/server/wrangler.json
+      - name: Verify production health
+        shell: bash
+        run: |
+          set -euo pipefail
+          endpoint="https://${CLOUDFLARE_CUSTOM_DOMAIN}/api/health"
+          for attempt in {1..12}; do
+            if payload="$(curl --fail --silent --show-error --max-time 15 "$endpoint")"; then
+              HEALTH_PAYLOAD="$payload" node --input-type=module <<'NODE'
+              const health = JSON.parse(process.env.HEALTH_PAYLOAD || "{}");
+              if (health.ok !== true || health.database !== true || health.googleOAuth !== true) {
+                throw new Error(`운영 상태가 준비되지 않았습니다: ${JSON.stringify(health)}`);
+              }
+              NODE
+              echo "운영 상태 확인 완료: $endpoint"
+              break
+            fi
+            if [[ $attempt -eq 12 ]]; then
+              echo "운영 상태 확인에 실패했습니다: $endpoint" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+      - name: Remove ephemeral secrets file
+        if: always()
+        run: rm -f "$RUNNER_TEMP/gongju-worker-secrets.json"
+      - name: Publish deployment summary
+        run: |
+          {
+            echo "## 공주 달 관찰 탐험대 배포 완료"
+            echo
+            echo "- 운영 주소: https://${CLOUDFLARE_CUSTOM_DOMAIN}"
+            echo "- OAuth callback: https://${CLOUDFLARE_CUSTOM_DOMAIN}/api/oauth/google/callback"
+            echo "- Health: https://${CLOUDFLARE_CUSTOM_DOMAIN}/api/health"
+            echo "- Commit: ${GITHUB_SHA}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/gongju-moon-observation-ci.yml

@@ -0,0 +1,50 @@
+name: Gongju Moon Observation CI
+
+on:
+  pull_request:
+    paths:
+      - "gongju-moon-observation/**"
+      - ".github/workflows/gongju-moon-observation-ci.yml"
+  push:
+    branches: [main]
+    paths:
+      - "gongju-moon-observation/**"
+      - ".github/workflows/gongju-moon-observation-ci.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gongju-moon-observation-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: gongju-moon-observation
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: gongju-moon-observation/package-lock.json
+      - run: npm ci
+      - run: npm run lint
+      - name: Verify existing application build and behavior
+        run: npm test
+      - name: Build direct Cloudflare target
+        env:
+          CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH: wrangler.cloudflare.jsonc
+        run: npm run build
+      - name: Verify direct Cloudflare deployment contract
+        run: node --test tests/cloudflare-deploy.test.mjs
+      - name: Preserve verified Worker build output
+        uses: actions/upload-artifact@v4
+        with:
+          name: gongju-moon-observation-build
+          path: gongju-moon-observation/dist
+          if-no-files-found: error
+          retention-days: 7

gongju-moon-observation/.gitignore

@@ -40,3 +40,4 @@ next-env.d.ts
 /.sites-runtime/
 /outputs/
 /work/
+/wrangler.cloudflare.deploy.json