project-auto-wizard 0.1.5

package/payload/workflows/common/PROJECT-COMMON-RELEASE-PUBLISH.yaml

@@ -0,0 +1,289 @@
+# ===================================================================
+# PROJECT-COMMON-RELEASE-PUBLISH.yaml
+# Tag + GitHub Release publisher (dual-mode)
+# ===================================================================
+#
+# Publishes a git tag (vX.Y.Z) and a GitHub Release for every release
+# that lands on {{MAIN_BRANCH}}. Two branch modes, read from version.yml
+# (metadata.template.branches.mode, default: pr-flow):
+#
+# - pr-flow: releases arrive as merge commits produced by
+#   AUTO-CHANGELOG-CONTROL. Only pushes whose head commit message matches
+#   the release-confirm pattern "chore(release):" proceed; anything else
+#   exits cleanly. Version + changelog were already confirmed in the PR.
+#
+# - trunk-based: every direct push to {{MAIN_BRANCH}} is a release.
+#   This job bumps the version (patch +1 and sync), summarizes the commits
+#   since the last tag with the ai-summary engine chain (user API ->
+#   GitHub Models -> rule-based fallback), updates CHANGELOG.json /
+#   CHANGELOG.md, and commits everything back with [skip ci].
+#
+# Common tail (both modes): recovery-aware idempotency guard (tag and
+# release checked separately so a half-published release can be finished
+# on re-run), tag push, release notes = changelog export (ai_notes) +
+# GitHub generate-notes API (contributors/compare links), then
+# gh release create.
+#
+# Release-confirm pattern: "chore(release):" — keep in sync with
+# PROJECT-COMMON-AUTO-CHANGELOG-CONTROL and PROJECT-COMMON-VERSION-CONTROL.
+#
+# workflow_dispatch republishes the current version (recovery path when a
+# previous run failed after the version was confirmed but before the
+# release was created). The idempotency guard keeps it safe to re-run.
+# ===================================================================
+
+name: PROJECT-RELEASE-PUBLISH
+
+concurrency:
+  group: release-publish
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: ["{{MAIN_BRANCH}}"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  models: read
+
+jobs:
+  release:
+    name: Tag and publish GitHub Release
+    # Bot housekeeping commits never publish releases
+    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          ref: "{{MAIN_BRANCH}}"
+
+      - name: Git config
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+      - name: Detect branch mode
+        id: mode
+        run: |
+          # scoped to the metadata: -> template: -> branches: chain so an
+          # unrelated top-level "mode:" key can never hijack the value
+          MODE=$(python3 -c 'import re; t=open("version.yml",encoding="utf-8").read(); m=re.search(r"metadata:.*?template:.*?branches:.*?mode:\s*\"?([A-Za-z-]+)", t, re.S); print(m.group(1) if m else "pr-flow")' 2>/dev/null || echo "pr-flow")
+          echo "mode=$MODE" >> $GITHUB_OUTPUT
+          echo "branch mode: $MODE"
+
+      - name: Release gate
+        id: gate
+        run: |
+          MODE="${{ steps.mode.outputs.mode }}"
+          EVENT="${{ github.event_name }}"
+          HEAD_MSG=$(git log -1 --pretty=%B)
+          PROCEED=false
+
+          if [ "$EVENT" = "workflow_dispatch" ]; then
+            # manual republish of the current version
+            PROCEED=true
+          elif [ "$MODE" = "trunk-based" ]; then
+            # every non-[skip ci] push to {{MAIN_BRANCH}} is a release
+            PROCEED=true
+          elif printf '%s\n' "$HEAD_MSG" | grep -q "chore(release):"; then
+            # pr-flow: only release-confirm merges publish a release
+            # (pattern shared with AUTO-CHANGELOG-CONTROL / VERSION-CONTROL)
+            PROCEED=true
+          fi
+
+          echo "proceed=$PROCEED" >> $GITHUB_OUTPUT
+          if [ "$PROCEED" = "true" ]; then
+            echo "release gate open (mode=$MODE, event=$EVENT)"
+          else
+            echo "not a release-confirm push in pr-flow mode — skipping (clean exit)"
+          fi
+
+      - name: Trunk-based version bump + changelog
+        if: >-
+          steps.gate.outputs.proceed == 'true' &&
+          steps.mode.outputs.mode == 'trunk-based' &&
+          github.event_name == 'push'
+        env:
+          AI_API_KEY: ${{ secrets.AI_API_KEY }}
+          AI_API_BASE_URL: ${{ vars.AI_API_BASE_URL }}
+          AI_MODEL: ${{ vars.AI_MODEL }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          # Idempotency: on a re-run of a failed job the checked-out HEAD may
+          # already be this workflow's own docs commit — never bump twice.
+          # Jump straight to the common tail (tag + release for the current
+          # version).
+          HEAD_MSG=$(git log -1 --pretty=%s)
+          if printf '%s\n' "$HEAD_MSG" | grep -q "^chore(version): release v.* docs \[skip ci\]"; then
+            echo "HEAD is already this workflow's release docs commit — skipping re-increment (idempotent re-run)"
+            exit 0
+          fi
+
+          NEW_VERSION=$(python3 .github/scripts/version_manager.py increment | tail -n 1)
+          if [ -z "$NEW_VERSION" ]; then
+            echo "version bump failed"
+            exit 1
+          fi
+          python3 .github/scripts/version_manager.py sync
+          echo "release version: $NEW_VERSION"
+
+          # Commits since the last tag (fall back to full history on first release)
+          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -n "$LAST_TAG" ]; then
+            echo "collecting commits since $LAST_TAG"
+            git log --pretty=%s "${LAST_TAG}..HEAD" > commits.txt
+          else
+            echo "no previous tag — collecting the full history"
+            git log --pretty=%s > commits.txt
+          fi
+
+          python3 .github/scripts/changelog_manager.py ai-summary \
+            --commits-file commits.txt \
+            --version "$NEW_VERSION" \
+            --output summary.md
+
+          # Same input channel as AUTO-CHANGELOG-CONTROL:
+          # update-from-summary reads ./pr_body.md
+          cp summary.md pr_body.md
+
+          # note: `grep | sed || echo default` never fires the default (the
+          # pipeline exits with sed's 0) — default via ${var:-} instead
+          PROJECT_TYPE=$(grep "^project_type:" version.yml 2>/dev/null | sed 's/project_type: *"\([^"]*\)".*/\1/')
+          PROJECT_TYPE=${PROJECT_TYPE:-unknown}
+          PROJECT_TYPES=$(grep "^project_types:" version.yml 2>/dev/null | sed -E 's/.*\[([^]]*)\].*/\1/' | tr -d '" ')
+          PROJECT_TYPES=${PROJECT_TYPES:-$PROJECT_TYPE}
+
+          export VERSION="$NEW_VERSION"
+          export PROJECT_TYPE PROJECT_TYPES
+          export TODAY=$(date '+%Y-%m-%d')
+          export TIMESTAMP=$(date '+%Y-%m-%dT%H:%M:%SZ')
+
+          python3 .github/scripts/changelog_manager.py update-from-summary
+          python3 .github/scripts/changelog_manager.py generate-md
+
+          rm -f pr_body.md summary.md commits.txt
+
+          git add -A
+          if git diff --staged --quiet; then
+            echo "no changes to commit"
+          else
+            git commit -m "chore(version): release v${NEW_VERSION} docs [skip ci]"
+
+            # Race-condition guard: pull-rebase then push (up to 3 retries)
+            MAX_RETRIES=3
+            RETRY_COUNT=0
+            PUSH_SUCCESS=false
+
+            while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+              RETRY_COUNT=$((RETRY_COUNT + 1))
+              echo "push attempt $RETRY_COUNT/$MAX_RETRIES..."
+
+              if git push origin HEAD:{{MAIN_BRANCH}}; then
+                PUSH_SUCCESS=true
+                echo "release docs pushed"
+                break
+              else
+                echo "push failed, syncing with remote..."
+                if git pull --rebase origin {{MAIN_BRANCH}}; then
+                  echo "rebase ok, retrying push..."
+                else
+                  echo "rebase failed, manual conflict resolution required"
+                  git rebase --abort 2>/dev/null || true
+                  exit 1
+                fi
+              fi
+            done
+
+            if [ "$PUSH_SUCCESS" = false ]; then
+              echo "push failed after $MAX_RETRIES attempts"
+              exit 1
+            fi
+          fi
+
+      - name: Resolve version + idempotency guard
+        id: version
+        if: steps.gate.outputs.proceed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(python3 .github/scripts/version_manager.py get | tail -n 1)
+          if [ -z "$VERSION" ]; then
+            echo "failed to read version"
+            exit 1
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+          git fetch --tags origin
+
+          # Recovery-aware idempotency: tag and release are checked
+          # separately, so a run that died between "tag pushed" and
+          # "release created" can be re-run and still publish the release.
+          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "tag_exists=true" >> $GITHUB_OUTPUT
+            echo "tag v$VERSION already exists — skipping tag push"
+          else
+            echo "tag_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+          if gh release view "v$VERSION" >/dev/null 2>&1; then
+            echo "release_exists=true" >> $GITHUB_OUTPUT
+            echo "release v$VERSION already exists — nothing to publish"
+          else
+            echo "release_exists=false" >> $GITHUB_OUTPUT
+            echo "publishing release v$VERSION"
+          fi
+
+      - name: Create and push tag
+        if: steps.gate.outputs.proceed == 'true' && steps.version.outputs.tag_exists != 'true'
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          git tag "v$VERSION"
+          git push origin "v$VERSION"
+          echo "tag v$VERSION pushed"
+
+      - name: Build release notes (changelog export + GitHub generate-notes)
+        if: steps.gate.outputs.proceed == 'true' && steps.version.outputs.release_exists != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+
+          # AI/changelog notes for this version
+          python3 .github/scripts/changelog_manager.py export --version "$VERSION" --output ai_notes.md || true
+
+          # GitHub-generated notes (contributors, compare link). Deliberately
+          # via the API instead of --generate-notes so both sources can be
+          # concatenated into a single notes file.
+          gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+            -f tag_name="v$VERSION" --jq '.body' > gh_notes.md || true
+
+          {
+            if [ -s ai_notes.md ]; then
+              cat ai_notes.md
+              echo ""
+            fi
+            if [ -s gh_notes.md ]; then
+              echo "---"
+              echo ""
+              cat gh_notes.md
+            fi
+          } > notes.md
+
+          if [ ! -s notes.md ]; then
+            echo "Release v$VERSION" > notes.md
+          fi
+
+          echo "release notes assembled ($(wc -c < notes.md) bytes)"
+
+      - name: Create GitHub Release
+        if: steps.gate.outputs.proceed == 'true' && steps.version.outputs.release_exists != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          gh release create "v$VERSION" --title "v$VERSION" --notes-file notes.md
+          echo "GitHub Release v$VERSION published"

package/payload/workflows/common/PROJECT-COMMON-VERSION-CONTROL.yaml

@@ -0,0 +1,192 @@
+# ===================================================================
+# PROJECT-COMMON-VERSION-CONTROL.yaml
+# Safety-net automatic version bump
+# ===================================================================
+#
+# [Safety net] Only when a direct push (one that did not go through a
+# release PR) lands on {{MAIN_BRANCH}} (production), this workflow bumps
+# the patch version and syncs every version file.
+#
+# Normal releases ({{DEVELOP_BRANCH}} -> {{MAIN_BRANCH}} PR) get their
+# version confirmed by AUTO-CHANGELOG-CONTROL before the merge. The merge
+# commit carries the release-confirm pattern "chore(release):" and the
+# push includes a version.yml change, so this workflow skips via its guard.
+#
+# In trunk-based mode (metadata.template.branches.mode: trunk-based)
+# RELEASE-PUBLISH owns version bumping, so this safety net is skipped
+# entirely to avoid double increments.
+#
+# Release-confirm pattern: "chore(release):" — keep in sync with
+# PROJECT-COMMON-AUTO-CHANGELOG-CONTROL and PROJECT-COMMON-RELEASE-PUBLISH.
+# ===================================================================
+
+name: PROJECT-VERSION-CONTROL
+
+# Prevent concurrent version bumps
+concurrency:
+  group: version-increment
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: ["{{MAIN_BRANCH}}"]
+    paths-ignore:
+      - 'CHANGELOG.md'
+      - 'CHANGELOG.json'
+      - 'version.yml'  # prevent infinite loop
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  version-bump:
+    name: Safety-net version bump
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          ref: "{{MAIN_BRANCH}}"
+
+      - name: Release merge / mode guard
+        id: release_guard
+        run: |
+          SKIP="false"
+
+          # trunk-based mode: RELEASE-PUBLISH owns versioning — skip safety net
+          MODE=$(python3 -c 'import re; t=open("version.yml",encoding="utf-8").read(); m=re.search(r"^\s*mode:\s*\"?([A-Za-z-]+)", t, re.M); print(m.group(1) if m else "pr-flow")' 2>/dev/null || echo "pr-flow")
+          if [ "$MODE" = "trunk-based" ]; then
+            SKIP="true"
+            echo "trunk-based mode detected — RELEASE-PUBLISH owns version bumping, skipping"
+          fi
+
+          # release-confirm pattern: the merge commit of a release PR
+          HEAD_MSG=$(git log -1 --pretty=%B)
+          if echo "$HEAD_MSG" | grep -q "chore(release):"; then
+            SKIP="true"
+            echo "release-confirm commit detected (chore(release):) — skipping safety-net bump"
+          fi
+
+          # release merge detection: the release push includes a version.yml change
+          BEFORE="${{ github.event.before }}"
+          if [ "$BEFORE" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$BEFORE" 2>/dev/null; then
+            RANGE="HEAD^..HEAD"
+          else
+            RANGE="$BEFORE..HEAD"
+          fi
+          if git diff --name-only $RANGE 2>/dev/null | grep -qx "version.yml"; then
+            SKIP="true"
+            echo "release merge detected (push contains a version.yml change) — skipping safety-net bump"
+          fi
+
+          echo "skip=$SKIP" >> $GITHUB_OUTPUT
+          if [ "$SKIP" = "false" ]; then
+            echo "direct push to {{MAIN_BRANCH}} detected — running safety-net version bump"
+          fi
+
+      - name: Read current version
+        id: current_version
+        if: steps.release_guard.outputs.skip != 'true'
+        run: |
+          CURRENT_VERSION=$(python3 .github/scripts/version_manager.py get | tail -n 1)
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "failed to read current version"
+            exit 1
+          fi
+          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          echo "current version: $CURRENT_VERSION"
+
+      - name: Bump patch version and sync
+        id: version
+        if: steps.release_guard.outputs.skip != 'true'
+        run: |
+          NEW_VERSION=$(python3 .github/scripts/version_manager.py increment | tail -n 1)
+          if [ -z "$NEW_VERSION" ]; then
+            echo "version bump failed"
+            exit 1
+          fi
+          python3 .github/scripts/version_manager.py sync
+          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "new version: $NEW_VERSION"
+
+      - name: Read project type
+        id: project_info
+        if: steps.release_guard.outputs.skip != 'true'
+        run: |
+          if [ -f "version.yml" ]; then
+            PROJECT_TYPE=$(grep "^project_type:" version.yml | sed 's/project_type: *"\([^"]*\)".*/\1/' || echo "unknown")
+            PROJECT_TYPES=$(grep "^project_types:" version.yml 2>/dev/null | sed -E 's/.*\[([^]]*)\].*/\1/' | tr -d '" ' || echo "")
+            if [ -z "$PROJECT_TYPES" ]; then
+              PROJECT_TYPES="$PROJECT_TYPE"
+            fi
+            echo "project_type=$PROJECT_TYPE" >> $GITHUB_OUTPUT
+            echo "project_types=$PROJECT_TYPES" >> $GITHUB_OUTPUT
+            echo "project type: $PROJECT_TYPE (types: $PROJECT_TYPES)"
+          else
+            echo "project_type=unknown" >> $GITHUB_OUTPUT
+            echo "project_types=unknown" >> $GITHUB_OUTPUT
+            echo "version.yml not found"
+          fi
+
+      - name: Commit and push changes
+        if: steps.release_guard.outputs.skip != 'true'
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+          git add -A
+
+          if git diff --staged --quiet; then
+            echo "no changes to commit (already in sync)"
+          else
+            NEW_VERSION="${{ steps.version.outputs.new_version }}"
+            COMMIT_MSG="chore(version): bump to v${NEW_VERSION} [skip ci]"
+
+            if git commit -m "$COMMIT_MSG"; then
+              # Race-condition guard: pull-rebase then push (up to 3 retries)
+              MAX_RETRIES=3
+              RETRY_COUNT=0
+              PUSH_SUCCESS=false
+
+              while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+                RETRY_COUNT=$((RETRY_COUNT + 1))
+                echo "push attempt $RETRY_COUNT/$MAX_RETRIES..."
+
+                if git push origin HEAD:{{MAIN_BRANCH}}; then
+                  PUSH_SUCCESS=true
+                  echo "version bump commit pushed"
+                  break
+                else
+                  echo "push failed, syncing with remote..."
+                  if git pull --rebase origin {{MAIN_BRANCH}}; then
+                    echo "rebase ok, retrying push..."
+                  else
+                    echo "rebase failed, manual conflict resolution required"
+                    git rebase --abort 2>/dev/null || true
+                    exit 1
+                  fi
+                fi
+              done
+
+              if [ "$PUSH_SUCCESS" = false ]; then
+                echo "push failed after $MAX_RETRIES attempts"
+                exit 1
+              fi
+            else
+              echo "commit failed"
+              exit 1
+            fi
+          fi
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "version-control workflow finished"
+          echo "  skipped (release merge / trunk-based): ${{ steps.release_guard.outputs.skip }}"
+          echo "  previous version: ${{ steps.current_version.outputs.current_version }}"
+          echo "  new version: ${{ steps.version.outputs.new_version }}"
+          echo "  branch: ${{ github.ref_name }}"

package/payload/workflows/common/secret-backup/PROJECT-COMMON-SECRET-FILE-UPLOAD.yaml

@@ -0,0 +1,209 @@
+# ===================================================================
+# PROJECT-COMMON-SECRET-FILE-UPLOAD.yaml
+# GitHub Secret 파일 서버(SSH) 자동 업로드
+# ===================================================================
+#
+# GitHub Secrets에 저장된 설정 파일들을 서버(SSH 접속 가능한 호스트)에
+# 자동 업로드하여 변경 이력을 추적합니다.
+# 타임스탬프 기반 백업으로 변경 히스토리를 보존합니다.
+#
+# ===================================================================
+# 🤖 AI 에이전트 커스텀 가이드
+# ===================================================================
+# 이 워크플로우를 프로젝트에 맞게 수정하려면,
+# 아래 프롬프트를 AI 에이전트에게 전달하세요:
+#
+# 📋 프롬프트:
+# "PROJECT-COMMON-SECRET-FILE-UPLOAD.yaml을
+#  프로젝트에 맞게 수정해줘.
+#  - 프로젝트명: {프로젝트명}
+#  - 역할(ROLE): {backend/frontend 등}
+#  - 서버 저장 경로: {서버 저장 경로}
+#  - SSH 포트: {포트번호}
+#  - 업로드할 GitHub Secrets:
+#    SECRET_KEY → 저장할_파일명.확장자
+#  기존 파일 목록 섹션에 추가하고,
+#  없는 Secret은 스킵하도록 해줘."
+#
+# 💡 예시:
+# "- APPLICATION_PROD_YML → application-prod.yml
+#  - FIREBASE_KEY_JSON → firebase-admin-sdk.json
+#  - VERTEX_SA_KEY → vertex-sa-key.json
+#  - ENV_FILE → .env
+#  - ADMIN_YML → admin.yml"
+# ===================================================================
+#
+# ===================================================================
+# 🔑 필수 GitHub Secrets
+# ===================================================================
+# SERVER_HOST: 서버 호스트(SSH 접속 주소)
+# SERVER_USER: SSH 사용자명
+# SERVER_PASSWORD: SSH 비밀번호
+# ===================================================================
+#
+# 🔧 환경변수 설정 (env 섹션에서 설정)
+# ===================================================================
+#
+# 📦 프로젝트 설정:
+# PROJECT_NAME: 프로젝트명 (서버 경로에 사용)
+# ROLE: 역할 구분 (backend, frontend 등)
+# SERVER_BASE_PATH: 서버 기본 경로 (기본: /volume1/projects, 예: AWS EC2 /home/ubuntu/projects)
+#
+# 🔌 SSH 연결:
+# SSH_PORT: SSH 포트 (기본: 2022)
+# ===================================================================
+
+name: PROJECT-COMMON-SECRET-FILE-UPLOAD
+
+# ===================================================================
+# 트리거 설정
+# ===================================================================
+# {{MAIN_BRANCH}} 브랜치에 push할 때 자동 실행됩니다.
+# workflow_dispatch로 수동 실행도 가능합니다.
+on:
+  push:
+    branches:
+      - "{{DEVELOP_BRANCH}}"
+  workflow_dispatch:
+
+concurrency:
+  group: secret-file-upload-${{ github.ref }}
+  cancel-in-progress: true
+
+# ===================================================================
+# 환경 변수 설정
+# ===================================================================
+env:
+  # 🔧 프로젝트 설정 - 프로젝트에 맞게 수정하세요
+  PROJECT_NAME: "my-project"
+  ROLE: "backend"
+  SERVER_BASE_PATH: "/volume1/projects"
+  SSH_PORT: "2022"
+
+jobs:
+  upload-secret-files:
+    name: Secret 파일 업로드
+    runs-on: ubuntu-latest
+    # [skip ci] 커밋 메시지가 포함된 경우 실행하지 않음
+    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+
+    steps:
+      - name: 타임스탬프 및 커밋 정보 생성
+        run: |
+          export TZ='Asia/Seoul'
+          TIMESTAMP=$(date '+%Y-%m-%d_%H-%M-%S')
+          echo "TIMESTAMP=$TIMESTAMP" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date '+%Y-%m-%d %H:%M')" >> $GITHUB_ENV
+          echo "SHORT_COMMIT_HASH=$(echo "${{ github.sha }}" | cut -c1-7)" >> $GITHUB_ENV
+          echo "생성된 타임스탬프: $TIMESTAMP"
+
+      - name: Secret 파일 업로드
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USER }}
+          password: ${{ secrets.SERVER_PASSWORD }}
+          port: ${{ env.SSH_PORT }}
+          script: |
+            set -e
+
+            # GitHub Actions 환경변수 직접 설정
+            PROJECT_NAME="${{ env.PROJECT_NAME }}"
+            ROLE="${{ env.ROLE }}"
+            SERVER_BASE_PATH="${{ env.SERVER_BASE_PATH }}"
+            TIMESTAMP="${{ env.TIMESTAMP }}"
+            SHORT_COMMIT_HASH="${{ env.SHORT_COMMIT_HASH }}"
+            BUILD_DATE="${{ env.BUILD_DATE }}"
+
+            # 경로 설정
+            BASE_DIR="${SERVER_BASE_PATH}/${PROJECT_NAME}/github_secret/${ROLE}"
+
+            echo "=== Secret 파일 업로드 시작 ==="
+            echo "프로젝트: ${PROJECT_NAME} (${ROLE})"
+            echo "경로: ${BASE_DIR}"
+            echo "타임스탬프: ${TIMESTAMP}"
+
+            # 디렉토리 생성
+            export PW="${{ secrets.SERVER_PASSWORD }}"
+            echo "$PW" | sudo -S mkdir -p "${BASE_DIR}/${TIMESTAMP}"
+
+            # ============================================
+            # 📦 파일 업로드 섹션
+            # Secret이 비어있으면 자동 스킵됩니다.
+            # AI 에이전트로 이 섹션에 파일을 추가하세요.
+            # ============================================
+
+            # --- ENV_FILE → .env ---
+            cat << '__SUH_SECRET_CHECK_EOF__' > /tmp/_secret_check
+            ${{ secrets.ENV_FILE }}
+            __SUH_SECRET_CHECK_EOF__
+            if [ -s /tmp/_secret_check ] && [ -n "$(tr -d '[:space:]' < /tmp/_secret_check)" ]; then
+              echo "ENV_FILE → .env 업로드 중..."
+              cat << '__SUH_FILE_CONTENT_EOF__' | sudo tee "${BASE_DIR}/.env" > /dev/null
+            ${{ secrets.ENV_FILE }}
+            __SUH_FILE_CONTENT_EOF__
+              cat << '__SUH_FILE_CONTENT_EOF__' | sudo tee "${BASE_DIR}/${TIMESTAMP}/.env" > /dev/null
+            ${{ secrets.ENV_FILE }}
+            __SUH_FILE_CONTENT_EOF__
+              echo ".env 업로드 완료"
+            else
+              echo "ENV_FILE 스킵 (Secret 미설정)"
+            fi
+            rm -f /tmp/_secret_check
+
+            # --- APPLICATION_PROD_YML → application-prod.yml ---
+            cat << '__SUH_SECRET_CHECK_EOF__' > /tmp/_secret_check
+            ${{ secrets.APPLICATION_PROD_YML }}
+            __SUH_SECRET_CHECK_EOF__
+            if [ -s /tmp/_secret_check ] && [ -n "$(tr -d '[:space:]' < /tmp/_secret_check)" ]; then
+              echo "APPLICATION_PROD_YML → application-prod.yml 업로드 중..."
+              cat << '__SUH_FILE_CONTENT_EOF__' | sudo tee "${BASE_DIR}/application-prod.yml" > /dev/null
+            ${{ secrets.APPLICATION_PROD_YML }}
+            __SUH_FILE_CONTENT_EOF__
+              cat << '__SUH_FILE_CONTENT_EOF__' | sudo tee "${BASE_DIR}/${TIMESTAMP}/application-prod.yml" > /dev/null
+            ${{ secrets.APPLICATION_PROD_YML }}
+            __SUH_FILE_CONTENT_EOF__
+              echo "application-prod.yml 업로드 완료"
+            else
+              echo "APPLICATION_PROD_YML 스킵 (Secret 미설정)"
+            fi
+            rm -f /tmp/_secret_check
+
+            # ============================================
+            # 📋 메타데이터 JSON 생성
+            # ============================================
+            cat << EOF | sudo tee "${BASE_DIR}/${TIMESTAMP}/cicd-gitignore-file.json" > /dev/null
+            {
+              "build_info": {
+                "timestamp": "$TIMESTAMP",
+                "workflow": "Secret 파일 자동 업로드",
+                "run_id": "${{ github.run_id }}",
+                "run_number": "${{ github.run_number }}",
+                "event": "${{ github.event_name }}",
+                "repository": "${{ github.repository }}",
+                "branch": "${{ github.ref_name }}",
+                "commit_hash": "${{ github.sha }}",
+                "short_hash": "$SHORT_COMMIT_HASH",
+                "commit_url": "https://github.com/${{ github.repository }}/commit/${{ github.sha }}",
+                "actor": "${{ github.actor }}",
+                "build_date": "$BUILD_DATE"
+              },
+              "files": [
+                {
+                  "secret_name": "ENV_FILE",
+                  "file_name": ".env",
+                  "last_updated": "$BUILD_DATE"
+                },
+                {
+                  "secret_name": "APPLICATION_PROD_YML",
+                  "file_name": "application-prod.yml",
+                  "last_updated": "$BUILD_DATE"
+                }
+              ]
+            }
+            EOF
+
+            # 타임스탬프 인덱스 업데이트
+            echo "{\"last_updated\": \"${TIMESTAMP}\", \"commit\": \"${SHORT_COMMIT_HASH}\", \"actor\": \"${{ github.actor }}\", \"status\": \"completed\"}" | sudo tee "${BASE_DIR}/timestamp_index.json" > /dev/null
+
+            echo "=== 모든 파일 업로드 완료 ==="