feat: redis, fileserver, httpclient 런타임 시점 구현 추가

2026-07-28 14:26:54 +09:00
parent 7363b2aa1e
commit b3add0162d
257 changed files with 30430 additions and 1357 deletions
@@ -0,0 +1,113 @@
+name: ci-quality-gates
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TESTCONTAINERS_REUSE_ENABLE: "false"
+
+jobs:
+  quality-gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Require the committed public-path security baseline
+        run: |
+          set -euo pipefail
+          readonly snapshot='docs/security/public-paths-snapshot.txt'
+          if [[ ! -s "${snapshot}" ]]; then
+            echo "::error::${snapshot} is missing or empty. CI must not let verifyPublicPathSnapshot create its own first-run baseline."
+            exit 1
+          fi
+          if ! git ls-files --error-unmatch "${snapshot}" >/dev/null 2>&1; then
+            echo "::error::${snapshot} exists locally but is not committed."
+            exit 1
+          fi
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Check quality, public paths, and dependency locks
+        working-directory: src
+        run: ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks --no-daemon --stacktrace
+
+  sample-off:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Verify the application without the sample fixture
+        working-directory: src
+        run: ./gradlew :app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies --no-daemon --stacktrace
+
+  gate-matrix-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Verify the gate matrix against the repository
+        run: bash .github/scripts/verify-gate-matrix.sh
+
+  # Advisory only. Quarantine expiry/drift remains blocking through verifyQuarantineSunset in check.
+  quarantine:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Run quarantined tests as an advisory signal
+        working-directory: src
+        run: ./gradlew quarantineTest --no-daemon
+
+  release-gate:
+    needs:
+      - quality-gates
+      - sample-off
+      - gate-matrix-lint
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every current blocking job to succeed
+        env:
+          QUALITY_RESULT: ${{ needs.quality-gates.result }}
+          SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
+          MATRIX_RESULT: ${{ needs.gate-matrix-lint.result }}
+        run: |
+          set -euo pipefail
+          for result in "${QUALITY_RESULT}" "${SAMPLE_OFF_RESULT}" "${MATRIX_RESULT}"; do
+            if [[ "${result}" != "success" ]]; then
+              echo "::error::release-gate: required job result was ${result}"
+              exit 1
+            fi
+          done
+          echo "release-gate: all current blocking quality jobs succeeded."