fix: Firebase 크리덴셜 CD 파이프라인 누락으로 인한 배포 실패 수정

[PBEM22]

원인

PR #211 (FCM 토큰)에서 FirebaseConfig가 추가됨. 이 클래스는 앱 시작 시 @PostConstruct에서 firebase-service-account.json을 classpath에서 로드함.

그런데 이 파일은 .gitignore에 등록된 민감 파일이라 Docker 이미지에 포함되지 않아 IOException → 앱 기동 실패 → 헬스체크 실패 → 배포 롤백 발생.

해결

• FIREBASE_SERVICE_ACCOUNT GitHub Secret(base64 인코딩된 JSON)을 CD에서 서버에 복원하는 step 추가
• docker-compose.yml blue/green 양쪽에 볼륨 마운트 추가: ./firebase-service-account.json:/app/resources/firebase-service-account.json:ro

사전 작업 (완료)

• FIREBASE_SERVICE_ACCOUNT GitHub Secret 등록 완료
• dev 서버 ~/app/firebase-service-account.json 수동 업로드 완료 (이번 배포 전까지 임시 대응)

테스트

머지 후 CD 자동 실행 → 헬스체크 통과 여부 확인

Summary by CodeRabbit

• 새로운 기능
  • 개발 및 운영 환경 배포 시 Firebase 인증 정보가 자동으로 복원됩니다.
  • 애플리케이션 컨테이너에서 Firebase 인증 파일을 읽기 전용으로 사용할 수 있습니다.

[coderabbitai]

Warning

Review limit reached

@PBEM22, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 83e2997e-0d2b-4b70-9bac-7d31d4e98c04

📥 Commits

Reviewing files that changed from the base of the PR and between bd28dad and c4fe5ef.

📒 Files selected for processing (1)

• .github/workflows/cd.yml

📝 Walkthrough

Walkthrough

배포 워크플로우가 Firebase 서비스 계정 파일을 원격 호스트에 복원하고, poti-blue·poti-green 컨테이너가 해당 파일을 읽기 전용으로 사용하도록 Docker Compose 구성이 추가되었습니다.

Changes

Firebase 자격 증명 배포

Layer / File(s)	Summary
배포 호스트 자격 증명 복원 .github/workflows/cd.yml	deploy-dev와 deploy-prod가 FIREBASE_SERVICE_ACCOUNT Secret을 base64 디코딩해 ~/app/firebase-service-account.json을 생성합니다.
blue-green 서비스 자격 증명 마운트 docker-compose.yml	poti-blue와 poti-green이 호스트의 ./firebase-service-account.json을 컨테이너의 /app/resources/firebase-service-account.json에 읽기 전용으로 마운트합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• team-poti/POTI-SERVER#207: 동일한 cd.yml의 개발·운영 원격 배포 잡과 배포 단계를 변경합니다.

Suggested labels: ⚙️ Infra, 🔥 P0

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Firebase 크리덴셜 복원과 Docker 마운트 추가로 인한 배포 실패 수정 내용을 잘 요약한 제목입니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/firebase-credentials-cd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd.yml:
- Around line 53-60: 개발 및 운영 배포의 Firebase 자격 증명 복원 단계에서 파일 생성 직후 test -s로 비어 있지
않은지 확인하고 JSON 형식 검증을 추가하세요. .github/workflows/cd.yml의 53-60행과 105-112행 두 위치에 동일한
검증을 적용하며, 검증 실패 시 배포가 즉시 실패하도록 구성하세요.
- Around line 53-60: Update both Firebase credential creation sites in
.github/workflows/cd.yml at lines 53-60 and 105-112, within the deploy-dev and
deploy-prod SSH scripts, to explicitly apply chmod 700 to
~/app/firebase-service-account.json immediately after decoding and creating the
file; retain the existing credential path and ensure both deployment flows
enforce the same minimum permissions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 577f9340-eee0-4333-b2d2-3dbf44658d6b

📥 Commits

Reviewing files that changed from the base of the PR and between 3d2d7f5 and bd28dad.

📒 Files selected for processing (2)

• .github/workflows/cd.yml
• docker-compose.yml