project-auto-wizard 0.13.3 → 0.14.0

package/payload/workflows/spring/server-deploy/PROJECT-SPRING-NONSTOP-TRAEFIK-CICD.yaml

@@ -1,62 +1,62 @@
 # project-auto-wizard:managed-workflow
-# Spring Boot 무중단 배포 (Traefik Blue-Green, SSH + Docker)
+# Spring Boot zero-downtime deploy (Traefik Blue-Green, SSH + Docker)
 #
-# deploy 브랜치 푸시 시 Docker 이미지를 빌드하고
-# Traefik 라벨 기반 Blue-Green 토글로 서버(SSH 접속 가능한 호스트)에 무중단 배포합니다.
+# On a push to the deploy branch, builds a Docker image and
+# deploys it with no downtime to a server (any SSH-reachable host) using a Traefik label based Blue-Green toggle.
 #
-# 본 워크플로우는 무중단 배포 옵션입니다.
-# 기본 배포는 PROJECT-SPRING-SIMPLE-CICD.yaml 입니다.
-# 전환하려면 아래 push.branches 주석 해제 + SIMPLE-CICD 의 push 트리거 주석 처리.
+# This workflow is the zero-downtime deploy option.
+# The default deploy is PROJECT-SPRING-SIMPLE-CICD.yaml.
+# To switch, uncomment push.branches below and comment out the push trigger in SIMPLE-CICD.
 #
-# 필수 GitHub Secrets
-# APPLICATION_PROD_YML (선택): application-prod.yml 내용
-# DOCKERHUB_USERNAME: DockerHub 사용자명
-# DOCKERHUB_TOKEN: DockerHub 액세스 토큰
-# SERVER_HOST: 배포 서버 주소
-# SERVER_USER: SSH 사용자명
-# SERVER_PASSWORD: SSH 비밀번호 (SSH_AUTH_METHOD=password일 때)
-# SSH_KEY: SSH 개인키 .pem 내용 (SSH_AUTH_METHOD=key일 때, AWS EC2 등)
+# Required GitHub Secrets
+# APPLICATION_PROD_YML (optional): contents of application-prod.yml
+# DOCKERHUB_USERNAME: DockerHub username
+# DOCKERHUB_TOKEN: DockerHub access token
+# SERVER_HOST: deployment server address
+# SERVER_USER: SSH username
+# SERVER_PASSWORD: SSH password (when SSH_AUTH_METHOD=password)
+# SSH_KEY: contents of the SSH private key .pem (when SSH_AUTH_METHOD=key, e.g. AWS EC2)
 #
-# 환경변수 설정 (env 섹션에서 설정)
+# Environment variables (set in the env section)
 #
-# 포트 및 컨테이너:
-# PROJECT_NAME: 프로젝트명 (컨테이너/이미지/Traefik router 이름)
-# SERVICE_DOMAIN: 외부 진입 도메인
-# CONTAINER_INTERNAL_PORT: Spring Boot 내부 포트 (기본: 8080)
+# Ports and containers:
+# PROJECT_NAME: project name (container/image/Traefik router name)
+# SERVICE_DOMAIN: external entry domain
+# CONTAINER_INTERNAL_PORT: Spring Boot internal port (default: 8080)
 #
 # Traefik:
-# TRAEFIK_NETWORK: Traefik docker 네트워크 (기본: traefik-network)
-# TRAEFIK_ENTRYPOINT: Traefik entrypoint 이름 (기본: web)
-# TRAEFIK_INTERNAL_PORT: NAS 호스트의 Traefik 진입 포트 (기본: 8079)
-# EXTRA_NETWORKS: 추가 docker 네트워크 (공백 구분, 예: selenium-chrome-network)
+# TRAEFIK_NETWORK: Traefik docker network (default: traefik-network)
+# TRAEFIK_ENTRYPOINT: Traefik entrypoint name (default: web)
+# TRAEFIK_INTERNAL_PORT: Traefik entry port on the NAS host (default: 8079)
+# EXTRA_NETWORKS: extra docker networks (space separated, e.g. selenium-chrome-network)
 #
-# 볼륨/스토리지:
-# ENABLE_VOLUME_MOUNT: 볼륨 마운트 여부 (true/false)
-# VOLUME_HOST_PATH: 호스트 볼륨 경로
-# VOLUME_CONTAINER_PATH: 컨테이너 내부 마운트 경로
+# Volume/storage:
+# ENABLE_VOLUME_MOUNT: whether to mount a volume (true/false)
+# VOLUME_HOST_PATH: host volume path
+# VOLUME_CONTAINER_PATH: mount path inside the container
 #
-# SSH 연결:
-# SSH_PORT: SSH 포트 (기본: 2022)
-# SSH_COMMAND_TIMEOUT: 명령 타임아웃 (기본: 600s)
-# SSH_CONNECTION_TIMEOUT: 연결 타임아웃 (기본: 60s)
+# SSH connection:
+# SSH_PORT: SSH port (default: 2022)
+# SSH_COMMAND_TIMEOUT: command timeout (default: 600s)
+# SSH_CONNECTION_TIMEOUT: connection timeout (default: 60s)
 #
-# 헬스체크:
-# HEALTHCHECK_PATH: Traefik 통한 GET 호출 path (기본: /)
-# HEALTHCHECK_ACCEPT_CODES: 통과 인정 HTTP 코드 (| 구분, 기본: 200|301|302|308)
-# HEALTHCHECK_MAX_RETRIES: 최대 시도 횟수 (기본: 36)
-# HEALTHCHECK_RETRY_INTERVAL: 재시도 간격 초 (기본: 5)
-# IN_FLIGHT_WAIT: old 컨테이너 제거 전 대기 초 (기본: 10)
+# Health check:
+# HEALTHCHECK_PATH: path for the GET call through Traefik (default: /)
+# HEALTHCHECK_ACCEPT_CODES: HTTP codes accepted as healthy (| separated, default: 200|301|302|308)
+# HEALTHCHECK_MAX_RETRIES: max attempts (default: 36)
+# HEALTHCHECK_RETRY_INTERVAL: retry interval in seconds (default: 5)
+# IN_FLIGHT_WAIT: seconds to wait before removing the old container (default: 10)
 #
-# 사전 조건:
-#   - 배포 서버에 Traefik 컨테이너가 traefik-network 에 띄워져 있어야 함
-#   - 역방향 프록시: ${SERVICE_DOMAIN}:443 → localhost:${TRAEFIK_INTERNAL_PORT}
-#     (예: Synology DSM 역방향 프록시, Nginx, Caddy 등)
+# Prerequisites:
+#   - a Traefik container must be running on the deploy server in traefik-network
+#   - reverse proxy: ${SERVICE_DOMAIN}:443 -> localhost:${TRAEFIK_INTERNAL_PORT}
+#     (e.g. Synology DSM reverse proxy, Nginx, Caddy)
 
 name: PROJECT-SPRING-NONSTOP-TRAEFIK-CICD
 
-# 트리거 설정
-# deploy 브랜치 push 자동 트리거는 주석 처리되어 있습니다.
-# 본 워크플로우로 전환하려면 아래 push.branches 주석을 해제하세요.
+# Trigger settings
+# The automatic trigger on a push to the deploy branch is commented out.
+# To switch to this workflow, uncomment push.branches below.
 on:
   # push:
   #   branches:
@@ -64,48 +64,48 @@ on:
   workflow_dispatch:
 
 env:
-  # 프로젝트 설정 - 실제 프로젝트명으로 변경하세요
+  # Project settings - change to your actual project name
   PROJECT_NAME: "__PROJECT_NAME__"  # @wizard ask:@repo
-  # 모노레포(--paths)에서 이 프로젝트가 있는 하위 경로. 빌드·Docker context의 기준 ('.'이면 레포 루트)
+  # Subdirectory of this project in a monorepo (--paths). Base for the build and Docker context ('.' = repo root)
   PROJECT_PATH: "."  # @wizard auto:project-path
-  # 모노레포(PROJECT_PATH가 '.'이 아님)에서는 이미지·컨테이너·도메인 이름에 '-spring'를 붙여
-  # 같은 레포의 다른 타입 서비스와 이름이 겹치지 않게 한다 (예: my-app-spring)
+  # In a monorepo (PROJECT_PATH is not '.') '-spring' is appended to image, container and domain names
+  # so they do not collide with services of other types in the same repo (e.g. my-app-spring)
   SERVICE_DOMAIN: "__SERVICE_DOMAIN__"  # @wizard ask:example.com
 
-  # Spring Boot 설정
+  # Spring Boot settings
   SPRING_PROFILE: "prod"
   JAVA_VERSION: "__JAVA_VERSION__"  # @wizard ask:@jdk
   GRADLE_OPTS: "-Dspring.profiles.active=prod"
 
-  # 경로 설정
+  # Path settings
   APPLICATION_YML_DIR: "__APPLICATION_YML_DIR__"  # @wizard auto:spring-app-yml-dir
-  DOCKERFILE_PATH: "./Dockerfile"  # PROJECT_PATH 기준 상대 경로
+  DOCKERFILE_PATH: "./Dockerfile"  # relative to PROJECT_PATH
 
-  # 포트 및 컨테이너 설정
+  # Port and container settings
   CONTAINER_INTERNAL_PORT: "8080"
 
-  # Traefik 설정 (서버의 Traefik 환경 구축 후 수정 금지)
+  # Traefik settings (do not change after the server's Traefik environment is set up)
   TRAEFIK_NETWORK: "traefik-network"
   TRAEFIK_ENTRYPOINT: "web"
   TRAEFIK_INTERNAL_PORT: "8079"
   EXTRA_NETWORKS: ""
 
-  # 볼륨 마운트 설정
+  # Volume mount settings
   ENABLE_VOLUME_MOUNT: "false"  # @wizard ask:false
   VOLUME_HOST_PATH: "/volume1/projects/__PROJECT_NAME__"  # @wizard ask:/volume1/projects/__PROJECT_NAME__
   VOLUME_CONTAINER_PATH: "/mnt/__PROJECT_NAME__"  # @wizard ask:/mnt/__PROJECT_NAME__
 
-  # SSH 인증 방식: "password"(Synology·일반 서버) | "key"(AWS EC2·.pem)
-  #   password → SERVER_PASSWORD secret 사용
-  #   key      → SSH_KEY secret 사용 (.pem 파일 전체 내용을 secret 값으로)
+  # SSH auth method: "password" (Synology / generic servers) | "key" (AWS EC2 / .pem)
+  #   password -> uses the SERVER_PASSWORD secret
+  #   key      -> uses the SSH_KEY secret (the full .pem contents as the secret value)
   SSH_AUTH_METHOD: "password"  # @wizard ask:password
 
-  # SSH 연결 설정
+  # SSH connection settings
   SSH_PORT: "__SSH_PORT__"  # @wizard ask:2022
   SSH_COMMAND_TIMEOUT: "600s"
   SSH_CONNECTION_TIMEOUT: "60s"
 
-  # 헬스체크 설정
+  # Health check settings
   HEALTHCHECK_PATH: "/"
   HEALTHCHECK_ACCEPT_CODES: "200|301|302|308"
   HEALTHCHECK_MAX_RETRIES: "36"
@@ -113,17 +113,17 @@ env:
   IN_FLIGHT_WAIT: "10"
 
 jobs:
-  # 빌드 작업
+  # Build job
   build:
-    name: Spring Boot 애플리케이션 빌드
+    name: Build Spring Boot application
     runs-on: ubuntu-latest
 
     steps:
-      - name: 코드 체크아웃
+      - name: Checkout code
         uses: actions/checkout@v7
 
-      # 필수 Secret·Dockerfile이 없으면 docker 로그인 같은 서드파티 오류 대신 빠진 항목을 알려 주고 멈춘다
-      - name: 배포 사전 점검 (Secret·Dockerfile)
+      # If a required Secret or the Dockerfile is missing, name it and stop instead of failing later in a third-party step such as docker login
+      - name: Deploy pre-check (Secrets and Dockerfile)
         working-directory: ${{ env.PROJECT_PATH }}
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -134,11 +134,12 @@ jobs:
           SSH_KEY: ${{ secrets.SSH_KEY }}
           DOCKERFILE: ${{ env.DOCKERFILE_PATH }}
         run: |
+          m() { python3 "$GITHUB_WORKSPACE/.github/scripts/messages.py" get "$@"; }
           MISSING=""
           for NAME in DOCKERHUB_USERNAME DOCKERHUB_TOKEN SERVER_HOST SERVER_USER; do
             [ -n "${!NAME}" ] || MISSING="$MISSING $NAME"
           done
-          # SSH_AUTH_METHOD=key면 SSH_KEY, 아니면 SERVER_PASSWORD가 필요하다
+          # SSH_AUTH_METHOD=key needs SSH_KEY, anything else needs SERVER_PASSWORD
           if [ "${SSH_AUTH_METHOD:-password}" = "key" ]; then
             [ -n "$SSH_KEY" ] || MISSING="$MISSING SSH_KEY"
           else
@@ -146,45 +147,46 @@ jobs:
           fi
           FAILED=false
           if [ -n "$MISSING" ]; then
-            echo "::error title=필수 Secret 누락::등록되지 않은 GitHub Secret:$MISSING — Settings → Secrets and variables → Actions에서 등록하세요"
+            echo "::error title=$(m cicd.precheck_secret_title)::$(m cicd.precheck_secret_body missing="$MISSING")"
             FAILED=true
           fi
           if [ ! -f "$DOCKERFILE" ]; then
-            echo "::error title=Dockerfile 없음::${PROJECT_PATH}/${DOCKERFILE#./} 파일이 없습니다. 이 워크플로우는 Docker 이미지로 배포하므로 Dockerfile이 필요합니다 (서버 배포를 하지 않는다면 이 워크플로우 파일을 삭제하세요)"
+            echo "::error title=$(m cicd.precheck_dockerfile_title)::$(m cicd.precheck_dockerfile_body path="${PROJECT_PATH}/${DOCKERFILE#./}")"
             FAILED=true
           fi
           if [ "$FAILED" = "true" ]; then
             exit 1
           fi
-          echo "✅ 사전 점검 통과: 필수 Secret과 Dockerfile이 모두 있습니다"
+          m cicd.precheck_ok
 
-      - name: Java 설정
+      - name: Set up Java
         uses: actions/setup-java@v5
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'temurin'
           cache: 'gradle'
 
-      - name: Gradle Wrapper 실행권한 부여
+      - name: Make Gradle wrapper executable
         working-directory: ${{ env.PROJECT_PATH }}
         run: chmod +x gradlew
 
-      - name: application-prod.yml 생성
+      - name: Generate application-prod.yml
         run: |
+          m() { python3 "$GITHUB_WORKSPACE/.github/scripts/messages.py" get "$@"; }
           mkdir -p ${{ env.APPLICATION_YML_DIR }}
           cat << 'EOF' > ./${{ env.APPLICATION_YML_DIR }}/application-prod.yml
           ${{ secrets.APPLICATION_PROD_YML }}
           EOF
-          echo "✅ application-prod.yml 파일 생성 완료 (${{ env.APPLICATION_YML_DIR }})"
+          m wf_spring_deploy.prod_yml_created dir="${{ env.APPLICATION_YML_DIR }}"
 
       - name: Build with Gradle
         working-directory: ${{ env.PROJECT_PATH }}
         run: ./gradlew clean build -x test ${{ env.GRADLE_OPTS }}
 
-      - name: Docker 빌드환경 설정
+      - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: DockerHub 로그인
+      - name: Log in to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -198,7 +200,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-buildx-
 
-      - name: Docker 이미지 빌드 및 푸시
+      - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
           context: ${{ env.PROJECT_PATH }}
@@ -213,16 +215,34 @@ jobs:
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
 
-  # 배포 작업 (Blue-Green 무중단)
+  # Deploy job (Blue-Green, zero downtime)
   deploy:
-    name: Blue-Green 무중단 배포
+    name: Blue-Green zero-downtime deploy
     needs: build
     runs-on: ubuntu-latest
 
     steps:
+      # The deploy script runs on the server, which has no messages.py:
+      # render the message catalog here and pass it along as a base64 env var
+      - name: Checkout message catalog
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            .github/scripts/messages.py
+            version.yml
+          sparse-checkout-cone-mode: false
+
+      - name: Load messages
+        run: |
+          MSGS="$(python3 "$GITHUB_WORKSPACE/.github/scripts/messages.py" dump wf_spring_deploy. \
+            | python3 -c 'import json, shlex, sys; d = json.load(sys.stdin); print("\n".join("M_%s=%s" % (k.replace(".", "_"), shlex.quote(v)) for k, v in d.items()))' \
+            | base64 | tr -d '\n')"
+          echo "PAW_MSG_B64=$MSGS" >> "$GITHUB_ENV"
+
       - name: Deploy
         uses: appleboy/ssh-action@v1.0.3
         env:
+          PAW_MSG_B64: ${{ env.PAW_MSG_B64 }}
           PROJECT_NAME: ${{ env.PROJECT_PATH != '.' && format('{0}-spring', env.PROJECT_NAME) || env.PROJECT_NAME }}
           SERVICE_DOMAIN: ${{ env.SERVICE_DOMAIN }}
           CONTAINER_INTERNAL_PORT: ${{ env.CONTAINER_INTERNAL_PORT }}
@@ -251,38 +271,48 @@ jobs:
           port: ${{ env.SSH_PORT }}
           command_timeout: ${{ env.SSH_COMMAND_TIMEOUT }}
           timeout: ${{ env.SSH_CONNECTION_TIMEOUT }}
-          envs: PROJECT_NAME,SERVICE_DOMAIN,CONTAINER_INTERNAL_PORT,SPRING_PROFILE,ENABLE_VOLUME_MOUNT,VOLUME_HOST_PATH,VOLUME_CONTAINER_PATH,EXTRA_NETWORKS,TRAEFIK_NETWORK,TRAEFIK_ENTRYPOINT,TRAEFIK_INTERNAL_PORT,HEALTHCHECK_PATH,HEALTHCHECK_ACCEPT_CODES,HEALTHCHECK_MAX_RETRIES,HEALTHCHECK_RETRY_INTERVAL,IN_FLIGHT_WAIT,BRANCH_REF,DOCKERHUB_USERNAME,SERVER_PASSWORD,SSH_AUTH_METHOD
+          envs: PROJECT_NAME,SERVICE_DOMAIN,CONTAINER_INTERNAL_PORT,SPRING_PROFILE,ENABLE_VOLUME_MOUNT,VOLUME_HOST_PATH,VOLUME_CONTAINER_PATH,EXTRA_NETWORKS,TRAEFIK_NETWORK,TRAEFIK_ENTRYPOINT,TRAEFIK_INTERNAL_PORT,HEALTHCHECK_PATH,HEALTHCHECK_ACCEPT_CODES,HEALTHCHECK_MAX_RETRIES,HEALTHCHECK_RETRY_INTERVAL,IN_FLIGHT_WAIT,BRANCH_REF,DOCKERHUB_USERNAME,SERVER_PASSWORD,SSH_AUTH_METHOD,PAW_MSG_B64
           script: |
             set -e
             export PATH=$PATH:/usr/local/bin
             export PW="${SERVER_PASSWORD}"
 
-            # SSH 인증 방식에 따른 sudo 추상화
+            # Messages arrive as base64 shell assignments (the server has no messages.py)
+            eval "$(printf '%s' "$PAW_MSG_B64" | base64 -d)"
+            m() {
+              local _v="M_wf_spring_deploy_$1" _kv
+              local _s="${!_v}"
+              shift
+              for _kv in "$@"; do _s=${_s//\{${_kv%%=*}\}/${_kv#*=}}; done
+              printf '%s\n' "$_s"
+            }
+
+            # Abstract sudo by SSH auth method
             SSH_AUTH_METHOD="${SSH_AUTH_METHOD:-password}"
             if [ "${SSH_AUTH_METHOD}" = "key" ]; then
               SUDO() { sudo "$@"; }
             else
               SUDO() { echo "$PW" | sudo -S "$@"; }
             fi
-            echo "🔐 SSH 인증 방식: ${SSH_AUTH_METHOD}"
+            m ssh_auth_method method="${SSH_AUTH_METHOD}"
 
             IMAGE="${DOCKERHUB_USERNAME}/${PROJECT_NAME}:${BRANCH_REF}"
             ROUTER_NAME="${PROJECT_NAME}"
 
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "🚀 Blue-Green 무중단 배포 시작"
+            m traefik_deploy_start
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "📦 프로젝트: ${PROJECT_NAME}"
-            echo "🌐 도메인: ${SERVICE_DOMAIN}"
-            echo "🖼️ 이미지: ${IMAGE}"
-            echo "🔧 Traefik 진입: localhost:${TRAEFIK_INTERNAL_PORT} (entrypoint=${TRAEFIK_ENTRYPOINT})"
+            m banner_project name="${PROJECT_NAME}"
+            m banner_domain domain="${SERVICE_DOMAIN}"
+            m banner_image image="${IMAGE}"
+            m traefik_entry port="${TRAEFIK_INTERNAL_PORT}" entrypoint="${TRAEFIK_ENTRYPOINT}"
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
-            # 1. 최신 이미지 Pull
-            echo "📥 이미지 Pull: ${IMAGE}"
+            # 1. Pull the latest image
+            m image_pull image="${IMAGE}"
             SUDO docker pull "${IMAGE}"
 
-            # 2. 현재 active 컨테이너 색 판별 (Traefik 라벨 부착 여부 기준)
+            # 2. Determine the color of the active container (by whether it carries the Traefik label)
             ACTIVE=$(SUDO docker ps \
               --filter "label=traefik.http.routers.${ROUTER_NAME}.rule" \
               --filter "name=${PROJECT_NAME}-" \
@@ -295,7 +325,7 @@ jobs:
               NEW_COLOR="blue"
               OLD_COLOR="green"
             else
-              # 최초 배포 또는 active 없음 → blue 부터 시작
+              # First deploy or no active container -> start with blue
               NEW_COLOR="blue"
               OLD_COLOR="green"
             fi
@@ -305,25 +335,25 @@ jobs:
 
             echo "🎨 active=${ACTIVE:-none} → new=${NEW_NAME}, old=${OLD_NAME}"
 
-            # 3. 동일 슬롯(idle 쪽) 잔존 컨테이너 정리
-            echo "🗑️ idle 슬롯 정리: ${NEW_NAME}"
+            # 3. Clean up a leftover container in the same (idle) slot
+            m idle_slot_cleanup name="${NEW_NAME}"
             SUDO docker rm -f "${NEW_NAME}" 2>/dev/null || true
 
-            # 4. 볼륨 마운트 옵션 구성
+            # 4. Build the volume mount option
             VOLUME_MOUNT_OPTION="-v /etc/localtime:/etc/localtime:ro"
             if [ "${ENABLE_VOLUME_MOUNT}" = "true" ]; then
               if [ ! -d "${VOLUME_HOST_PATH}" ]; then
-                echo "📁 볼륨 마운트 디렉토리 생성: ${VOLUME_HOST_PATH}"
+                m volume_mkdir path="${VOLUME_HOST_PATH}"
                 SUDO mkdir -p "${VOLUME_HOST_PATH}"
               fi
               VOLUME_MOUNT_OPTION="${VOLUME_MOUNT_OPTION} -v ${VOLUME_HOST_PATH}:${VOLUME_CONTAINER_PATH}"
-              echo "📦 볼륨 마운트 활성화: ${VOLUME_HOST_PATH} → ${VOLUME_CONTAINER_PATH}"
+              m volume_enabled host="${VOLUME_HOST_PATH}" container="${VOLUME_CONTAINER_PATH}"
             else
-              echo "ℹ️ 볼륨 마운트 비활성화됨"
+              m volume_disabled
             fi
 
-            # 5. 새 컨테이너 기동 (Traefik 라벨 포함)
-            echo "🐳 새 컨테이너 기동: ${NEW_NAME}"
+            # 5. Start the new container (with Traefik labels)
+            m new_container_start name="${NEW_NAME}"
             SUDO docker run -d \
               --name "${NEW_NAME}" \
               --network "${TRAEFIK_NETWORK}" \
@@ -336,21 +366,21 @@ jobs:
               ${VOLUME_MOUNT_OPTION} \
               "${IMAGE}"
 
-            # 6. 추가 네트워크 연결 (EXTRA_NETWORKS, 공백 구분)
+            # 6. Connect extra networks (EXTRA_NETWORKS, space separated)
             if [ -n "${EXTRA_NETWORKS}" ]; then
               for net in ${EXTRA_NETWORKS}; do
-                echo "🔗 추가 네트워크 연결: ${net}"
+                m traefik_extra_network net="${net}"
                 SUDO docker network connect "${net}" "${NEW_NAME}" 2>/dev/null || true
               done
             fi
 
-            # 7. Traefik 라벨 디버그 출력 (escape 검증용)
-            echo "🔍 Traefik 라벨 확인:"
+            # 7. Print the Traefik labels for debugging (to verify escaping)
+            m traefik_labels
             SUDO docker inspect "${NEW_NAME}" --format '{{range $k, $v := .Config.Labels}}  {{$k}} = {{$v}}{{"\n"}}{{end}}' | grep traefik || true
 
-            # 8. 헬스체크 — Traefik 통한 라우팅 확인
+            # 8. Health check - verify routing through Traefik
             MAX_WAIT=$((HEALTHCHECK_MAX_RETRIES * HEALTHCHECK_RETRY_INTERVAL))
-            echo "⏳ 헬스체크 시작 (최대 ${MAX_WAIT}초, ${HEALTHCHECK_MAX_RETRIES}회 × ${HEALTHCHECK_RETRY_INTERVAL}초)"
+            m traefik_hc_start max_wait="${MAX_WAIT}" retries="${HEALTHCHECK_MAX_RETRIES}" interval="${HEALTHCHECK_RETRY_INTERVAL}"
 
             RETRY_COUNT=0
             HEALTHCHECK_SUCCESS=false
@@ -362,12 +392,12 @@ jobs:
               STATUS=$(SUDO docker inspect --format='{{.State.Status}}' "${NEW_NAME}" 2>/dev/null || echo "not_found")
 
               if [ "$STATUS" = "exited" ]; then
-                echo "❌ 컨테이너 비정상 종료 (exited). 로그 200줄:"
+                m traefik_exited
                 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
                 SUDO docker logs --tail 200 "${NEW_NAME}"
                 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-                echo "ℹ️ 컨테이너 ${NEW_NAME} 유지 (자동 삭제 안 함) — 수동 검증/디버깅"
-                echo "ℹ️ old=${OLD_NAME} 존재 시 그대로 유지 → 사실상 자동 롤백"
+                m traefik_kept name="${NEW_NAME}"
+                m traefik_rollback_note name="${OLD_NAME}"
                 exit 1
               fi
 
@@ -377,64 +407,64 @@ jobs:
                   "http://localhost:${TRAEFIK_INTERNAL_PORT}${HEALTHCHECK_PATH}" 2>/dev/null || echo "000")
 
                 if echo "$HTTP_CODE" | grep -Eq "^(${HEALTHCHECK_ACCEPT_CODES})$"; then
-                  echo "✅ 헬스체크 통과 (${RETRY_COUNT}/${HEALTHCHECK_MAX_RETRIES}) HTTP=${HTTP_CODE}"
+                  m traefik_hc_pass n="${RETRY_COUNT}" max="${HEALTHCHECK_MAX_RETRIES}" code="${HTTP_CODE}"
                   HEALTHCHECK_SUCCESS=true
                   break
                 fi
               fi
 
-              echo "⏳ 대기 (${RETRY_COUNT}/${HEALTHCHECK_MAX_RETRIES}) status=${STATUS} http=${HTTP_CODE:-?}"
+              m traefik_waiting n="${RETRY_COUNT}" max="${HEALTHCHECK_MAX_RETRIES}" status="${STATUS}" http="${HTTP_CODE:-?}"
             done
 
             if [ "$HEALTHCHECK_SUCCESS" = "false" ]; then
-              echo "❌ 헬스체크 타임아웃 (${MAX_WAIT}초)"
+              m traefik_hc_timeout sec="${MAX_WAIT}"
               echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-              echo "🔍 ${NEW_NAME} 최근 200줄 로그:"
+              m traefik_logs_header name="${NEW_NAME}"
               echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
               SUDO docker logs --tail 200 "${NEW_NAME}"
               echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-              echo "ℹ️ 컨테이너 ${NEW_NAME} 유지 (자동 삭제 안 함) — 수동 검증/디버깅"
-              echo "ℹ️ old=${OLD_NAME} 존재 시 그대로 유지 → 사실상 자동 롤백"
+              m traefik_kept name="${NEW_NAME}"
+              m traefik_rollback_note name="${OLD_NAME}"
               exit 1
             fi
 
-            # 9. in-flight 처리 + old 컨테이너 자동 제거
+            # 9. Let in-flight requests finish, then remove the old container automatically
             if SUDO docker ps -a --format '{{.Names}}' | grep -Eq "^${OLD_NAME}$"; then
-              echo "⏱️ in-flight 요청 처리 대기 (${IN_FLIGHT_WAIT}초)"
+              m inflight_wait sec="${IN_FLIGHT_WAIT}"
               sleep ${IN_FLIGHT_WAIT}
-              echo "🗑️ old=${OLD_NAME} 제거"
+              m old_removed name="${OLD_NAME}"
               SUDO docker rm -f "${OLD_NAME}"
             else
-              echo "ℹ️ old=${OLD_NAME} 없음 — 정리 생략"
+              m old_absent name="${OLD_NAME}"
             fi
 
-            # 10. dangling 이미지 정리
-            echo "🧹 dangling(<none>) 이미지 정리..."
+            # 10. Clean up dangling images
+            m prune_dangling
             SUDO docker image prune -af
 
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "✅ 무중단 배포 완료. active=${NEW_NAME}"
-            echo "🌐 도메인: https://${SERVICE_DOMAIN}"
+            m traefik_done name="${NEW_NAME}"
+            m banner_domain domain="https://${SERVICE_DOMAIN}"
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
-# 사용 방법
+# Usage
 #
-# 1) GitHub Secrets 등록:
+# 1) Register the GitHub Secrets:
 #    APPLICATION_PROD_YML, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN,
 #    SERVER_HOST, SERVER_USER, SERVER_PASSWORD
 #
-# 2) 본 워크플로우의 env 블록에서 프로젝트별 설정 수정:
+# 2) Edit the project-specific settings in this workflow's env block:
 #    - PROJECT_NAME, SERVICE_DOMAIN
 #    - APPLICATION_YML_DIR, CONTAINER_INTERNAL_PORT
 #    - ENABLE_VOLUME_MOUNT, VOLUME_HOST_PATH, VOLUME_CONTAINER_PATH
-#    - EXTRA_NETWORKS (예: selenium-chrome-network)
+#    - EXTRA_NETWORKS (e.g. selenium-chrome-network)
 #    - HEALTHCHECK_PATH, HEALTHCHECK_ACCEPT_CODES
 #
-# 3) 서버 사전 준비:
-#    - Traefik 컨테이너가 traefik-network 에 띄워져 있어야 함
-#    - 역방향 프록시: ${SERVICE_DOMAIN}:443 → localhost:${TRAEFIK_INTERNAL_PORT}
-#      (예: Synology DSM 역방향 프록시, Nginx, Caddy 등)
+# 3) Server preparation:
+#    - a Traefik container must be running in traefik-network
+#    - reverse proxy: ${SERVICE_DOMAIN}:443 -> localhost:${TRAEFIK_INTERNAL_PORT}
+#      (e.g. Synology DSM reverse proxy, Nginx, Caddy)
 #
-# 4) 본 워크플로우로 전환:
-#    - 본 파일의 push.branches 주석 해제
-#    - PROJECT-SPRING-SIMPLE-CICD.yaml 의 push 트리거 주석 처리
+# 4) Switch to this workflow:
+#    - uncomment push.branches in this file
+#    - comment out the push trigger in PROJECT-SPRING-SIMPLE-CICD.yaml