Slack 승인 배포 자동화

# 프로젝트 루트에서 실행
echo "xoxb-your-token-here" > .slack-bot-token
 
# .gitignore에 추가 (이미 되어 있다면 생략)
echo ".slack-bot-token" >> .gitignore

참고: Request URL은 Worker 배포 후에 동작합니다. 순서상 먼저 설정해두고, Worker를 배포하면 자동으로 연결됩니다.

# 1. Slack 채널에서 앱 초대
/invite @Kainos Web Deploy
 
# 2. 채널 ID 확인: 채널 이름 클릭 → 하단에 C로 시작하는 ID
# 예: C0ARWQ54J2V
 
# 3. 프로젝트 루트에 저장
echo "C0ARWQ54J2V" > .slack-channel-id

name = "slack-approval"
main = "worker.js"
compatibility_date = "2026-03-27"
preview_urls = false
 
routes = [
  { pattern = "slack-approval.yourdomain.com", custom_domain = true }
]
 
[vars]
GITHUB_REPO = "your-github-username/your-repo-name"
 
# Secrets (wrangler secret put 으로 설정):
# SLACK_SIGNING_SECRET  — Slack 앱 > Basic Information > Signing Secret
# GITHUB_TOKEN          — GitHub PAT (Contents read/write 권한)

/**
 * Cloudflare Worker: Slack Approval
 *
 * Slack 버튼 클릭 이벤트를 수신하여:
 *  - 승인: GitHub API로 develop → main 머지
 *  - 반려: .regenerate 마커 파일 생성 → 다음 스케줄에서 재생성
 */
 
export default {
  async fetch(request, env, ctx) {
    if (request.method !== "POST") {
      return new Response("Method Not Allowed", { status: 405 });
    }
    const url = new URL(request.url);
    if (url.pathname === "/interact") {
      return handleInteraction(request, env, ctx);
    }
    return new Response("Not Found", { status: 404 });
  },
};
 
async function handleInteraction(request, env, ctx) {
  const body = await request.text();
 
  // Slack 서명 검증
  const isValid = await verifySlackRequest(request, body, env.SLACK_SIGNING_SECRET);
  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }
 
  // Slack payload 파싱 (URL-encoded form: payload=JSON)
  const params = new URLSearchParams(body);
  const payload = JSON.parse(params.get("payload"));
  const action = payload.actions[0];
  const actionId = action.action_id;
  const responseUrl = payload.response_url;
  const user = payload.user.username;
 
  let meta = {};
  try { meta = JSON.parse(action.value || "{}"); } catch (e) {}
 
  if (actionId === "approve_deploy") {
    ctx.waitUntil(handleApprove(env, responseUrl, user, meta));
    return jsonResponse({
      replace_original: true,
      text: "⏳ 승인 처리 중...",
    });
  }
 
  if (actionId === "reject_deploy") {
    ctx.waitUntil(handleReject(env, responseUrl, user, meta));
    return jsonResponse({
      replace_original: true,
      text: "⏳ 반려 처리 중...",
    });
  }
 
  return jsonResponse({ text: "Unknown action" });
}
 
async function handleApprove(env, responseUrl, user, meta) {
  try {
    const res = await fetch(
      \`https://api.github.com/repos/\${env.GITHUB_REPO}/merges\`,
      {
        method: "POST",
        headers: {
          Authorization: \`Bearer \${env.GITHUB_TOKEN}\`,
          "Content-Type": "application/json",
          "User-Agent": "slack-approval-worker",
          Accept: "application/vnd.github.v3+json",
        },
        body: JSON.stringify({
          base: "main",
          head: "develop",
          commit_message: \`deploy: \${meta.slug || "content"} (approved by @\${user})\`,
        }),
      }
    );
 
    let message;
    if (res.status === 201) {
      message = "✅ 승인 완료! develop → main 머지 성공. 배포가 진행됩니다.";
    } else if (res.status === 204) {
      message = "ℹ️ 이미 최신 상태입니다.";
    } else if (res.status === 409) {
      message = "⚠️ 머지 충돌 발생. 수동으로 해결해주세요.";
    } else {
      const errBody = await res.text();
      message = \`❌ 머지 실패 (\${res.status}): \${errBody}\`;
    }
    await updateSlackMessage(responseUrl, message);
  } catch (e) {
    await updateSlackMessage(responseUrl, \`❌ 오류: \${e.message}\`);
  }
}
 
async function handleReject(env, responseUrl, user, meta) {
  try {
    const type = meta.type || "insight";
    const slug = meta.slug || "unknown";
    const markerPath = \`scripts/.regenerate-\${type}\`;
    const content = btoa(JSON.stringify({
      slug, requestedAt: new Date().toISOString(), requestedBy: user
    }));
 
    // 기존 마커 파일 SHA 확인
    let sha = null;
    const getRes = await fetch(
      \`https://api.github.com/repos/\${env.GITHUB_REPO}/contents/\${markerPath}?ref=develop\`,
      {
        headers: {
          Authorization: \`Bearer \${env.GITHUB_TOKEN}\`,
          "User-Agent": "slack-approval-worker",
          Accept: "application/vnd.github.v3+json",
        },
      }
    );
    if (getRes.ok) { sha = (await getRes.json()).sha; }
 
    const putBody = { message: \`chore: request regeneration of \${slug}\`, content, branch: "develop" };
    if (sha) putBody.sha = sha;
 
    await fetch(
      \`https://api.github.com/repos/\${env.GITHUB_REPO}/contents/\${markerPath}\`,
      {
        method: "PUT",
        headers: {
          Authorization: \`Bearer \${env.GITHUB_TOKEN}\`,
          "Content-Type": "application/json",
          "User-Agent": "slack-approval-worker",
          Accept: "application/vnd.github.v3+json",
        },
        body: JSON.stringify(putBody),
      }
    );
 
    await updateSlackMessage(responseUrl,
      \`🔄 반려됨. \${slug} 재생성이 다음 스케줄에서 실행됩니다.\`);
  } catch (e) {
    await updateSlackMessage(responseUrl, \`❌ 반려 처리 오류: \${e.message}\`);
  }
}
 
async function updateSlackMessage(responseUrl, text) {
  await fetch(responseUrl, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ replace_original: true, text }),
  });
}
 
async function verifySlackRequest(request, body, signingSecret) {
  const timestamp = request.headers.get("X-Slack-Request-Timestamp");
  if (!timestamp) return false;
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) return false;
 
  const sigBasestring = \`v0:\${timestamp}:\${body}\`;
  const key = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(signingSecret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"]
  );
  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(sigBasestring));
  const hexSig = "v0=" + [...new Uint8Array(sig)]
    .map((b) => b.toString(16).padStart(2, "0")).join("");
  return hexSig === request.headers.get("X-Slack-Signature");
}
 
function jsonResponse(data) {
  return new Response(JSON.stringify(data), {
    headers: { "Content-Type": "application/json" },
  });
}

# Worker 디렉토리로 이동
cd workers/slack-approval
 
# Worker 배포
npx wrangler deploy
 
# Slack Signing Secret 설정 (Slack 앱 > Basic Information에서 복사한 값)
npx wrangler secret put SLACK_SIGNING_SECRET
# → 프롬프트에 Signing Secret 값 붙여넣기
 
# GitHub Token 설정 (5단계에서 생성한 PAT)
npx wrangler secret put GITHUB_TOKEN
# → 프롬프트에 github_pat_... 값 붙여넣기

참고: Worker 배포 시 custom_domain 설정에 의해 Cloudflare DNS에 자동으로 도메인이 추가됩니다. 별도의 DNS 설정이 필요 없습니다.

# Slack Bot Token과 채널 ID를 파일에서 읽기
SLACK_BOT_TOKEN_FILE="$PROJECT_DIR/.slack-bot-token"
SLACK_CHANNEL_FILE="$PROJECT_DIR/.slack-channel-id"
 
# 프리뷰 URL (Cloudflare Pages develop 브랜치)
PREVIEW_URL="https://develop.your-project.pages.dev/insights/$NEXT_SLUG"
 
# Slack 승인/반려 버튼 전송
curl -s -X POST "https://slack.com/api/chat.postMessage" \
  -H "Authorization: Bearer $(cat $SLACK_BOT_TOKEN_FILE)" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "'$(cat $SLACK_CHANNEL_FILE)'",
    "blocks": [
      {"type":"header","text":{"type":"plain_text","text":"새 인사이트가 생성되었습니다"}},
      {"type":"section","fields":[
        {"type":"mrkdwn","text":"*제목:*\nINSIGHT_TITLE"},
        {"type":"mrkdwn","text":"*날짜:*\n2026-04-09"}
      ]},
      {"type":"section","text":{"type":"mrkdwn","text":"*미리보기:*\n<PREVIEW_URL|dev에서 확인>"}},
      {"type":"actions","elements":[
        {"type":"button","text":{"type":"plain_text","text":"✅ 승인 & 배포"},"style":"primary","action_id":"approve_deploy","value":"{\"slug\":\"SLUG\",\"type\":\"insight\"}"},
        {"type":"button","text":{"type":"plain_text","text":"❌ 반려 & 재생성"},"style":"danger","action_id":"reject_deploy","value":"{\"slug\":\"SLUG\",\"type\":\"insight\"}"}
      ]}
    ]
  }'

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>kr.kainos.daily-insight</string>
 
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>/path/to/your/project/scripts/daily-insight.sh</string>
    </array>
 
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>21</integer>
        <key>Minute</key>
        <integer>0</integer>
    </dict>
 
    <key>StandardOutPath</key>
    <string>/path/to/your/project/scripts/daily-insight.log</string>
    <key>StandardErrorPath</key>
    <string>/path/to/your/project/scripts/daily-insight.log</string>
 
    <key>EnvironmentVariables</key>
    <dict>
        <key>PATH</key>
        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>
        <key>HOME</key>
        <string>/Users/yourname</string>
    </dict>
</dict>
</plist>

# 등록
launchctl bootstrap gui/$(id -u) \
  ~/Library/LaunchAgents/kr.kainos.daily-insight.plist
 
# 즉시 실행 (테스트)
launchctl kickstart -k gui/$(id -u)/kr.kainos.daily-insight
 
# 상태 확인
launchctl list | grep kainos
 
# 해제 (중단)
launchctl bootout gui/$(id -u)/kr.kainos.daily-insight