refactor(web): migrate database access from TypeORM to Prisma

.github/gitops/allclear-prod-prisma-migrate.yaml

@@ -0,0 +1,59 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: allclear-web-prisma-migrate
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+spec:
+  backoffLimit: 0
+  activeDeadlineSeconds: 900
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: allclear
+      nodeSelector:
+        kubernetes.io/arch: arm64
+      restartPolicy: Never
+      containers:
+        - name: prisma-migrate
+          image: yny.ocir.io/ax1dvc8vmenm/allclear-prod/allclear-web
+          workingDir: /app/prisma-migrator
+          command:
+            - /app/prisma-migrator/node_modules/.bin/prisma
+            - migrate
+            - deploy
+          env:
+            - name: DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: allclear-prod
+                  key: DB_HOST
+            - name: DB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: allclear-prod
+                  key: DB_PORT
+            - name: DB_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: allclear-prod
+                  key: DB_USERNAME
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: allclear-prod
+                  key: DB_PASSWORD
+            - name: DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: allclear-prod
+                  key: DB_NAME
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 1Gi

.github/scripts/update-gitops-web-with-migration.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+overlay_path="${GITOPS_OVERLAY_PATH:?missing GitOps overlay path}"
+image="${WEB_IMAGE:?missing web image}"
+tag="${WEB_IMAGE_TAG:?missing web image tag}"
+job_manifest="allclear-web-prisma-migrate.yaml"
+
+if [[ "$overlay_path" != "argocd/allclear-prod" ]]; then
+  echo "This migration Job can only update the production overlay." >&2
+  exit 1
+fi
+
+cd "$source_root/.gitops/$overlay_path"
+git config user.name 'waffle-image-update[bot]'
+git config user.email '260899885+waffle-image-update[bot]@users.noreply.github.com'
+
+for attempt in 1 2 3 4 5; do
+  git fetch --quiet origin main
+  git reset --quiet --hard origin/main
+
+  cp "$source_root/.github/gitops/allclear-prod-prisma-migrate.yaml" "$job_manifest"
+  if ! yq e '.resources[] | select(. == "allclear-web-prisma-migrate.yaml")' kustomization.yaml | grep -qxF "$job_manifest"; then
+    kustomize edit add resource "$job_manifest"
+  fi
+  kustomize edit set image "$image:$tag"
+
+  rendered="$(kustomize build .)"
+  job_image="$(printf '%s\n' "$rendered" | yq ea -N 'select(.kind == "Job" and .metadata.name == "allclear-web-prisma-migrate") | .spec.template.spec.containers[0].image')"
+  web_image="$(printf '%s\n' "$rendered" | yq ea -N 'select(.kind == "Deployment" and .metadata.name == "allclear-web") | .spec.template.spec.containers[0].image')"
+  if [[ "$job_image" != "$image:$tag" || "$web_image" != "$image:$tag" ]]; then
+    echo "The migration Job and web Deployment must render with the same image tag." >&2
+    exit 1
+  fi
+
+  git add -- kustomization.yaml "$job_manifest"
+  if git diff --cached --quiet; then
+    echo "Production GitOps image and migration Job are already up to date."
+    exit 0
+  fi
+
+  git commit --quiet -m "build: update allclear-prod/allclear-web to $tag with Prisma migration Job"
+  if git push --quiet origin HEAD:main; then
+    exit 0
+  fi
+
+  echo "GitOps push attempt $attempt failed; retrying on the latest main."
+  sleep $(( (RANDOM % 5) + 1 ))
+done
+
+echo "Could not update production GitOps after 5 attempts." >&2
+exit 1

.github/workflows/_deploy-web.yml

@@ -11,6 +11,11 @@ on:
         description: Kustomize overlay path in waffle-world-oci
         required: true
         type: string
+      run_prisma_migrations:
+        description: Add a Prisma PreSync Job to the production GitOps overlay
+        required: false
+        default: false
+        type: boolean
     secrets:
       OCI_AUTH_TOKEN:
         required: true
@@ -51,10 +56,20 @@ jobs:
             --tag "$OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG" \
             .
 
+      - name: Validate Prisma migration runner
+        run: |
+          docker run --rm \
+            --platform linux/arm64 \
+            --workdir /app/prisma-migrator \
+            --entrypoint /app/prisma-migrator/node_modules/.bin/prisma \
+            "$OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG" \
+            validate
+
       - name: Push web image
         run: docker push "$OCIR_REGISTRY/$OCIR_NAMESPACE/$OCIR_REPOSITORY:$IMAGE_TAG"
 
       - name: Update GitOps image tag
+        if: ${{ !inputs.run_prisma_migrations }}
         uses: wafflestudio/waffle-world-oci/.github/actions/update-image@main
         with:
           image: ${{ env.OCIR_REGISTRY }}/${{ env.OCIR_NAMESPACE }}/${{ env.OCIR_REPOSITORY }}
@@ -63,3 +78,29 @@ jobs:
           # overlay is rooted at the environment directory (for example, argocd/allclear-dev).
           overlay-path: ${{ inputs.gitops_overlay_path }}
           private-key: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
+
+      - name: Generate GitOps App token
+        if: ${{ inputs.run_prisma_migrations }}
+        id: gitops-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: Iv23lijiSk5hqJhw5DsY
+          private-key: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}
+          owner: wafflestudio
+          repositories: waffle-world-oci
+
+      - name: Checkout GitOps repository
+        if: ${{ inputs.run_prisma_migrations }}
+        uses: actions/checkout@v7
+        with:
+          repository: wafflestudio/waffle-world-oci
+          token: ${{ steps.gitops-token.outputs.token }}
+          path: .gitops
+
+      - name: Update production image and migration Job
+        if: ${{ inputs.run_prisma_migrations }}
+        env:
+          GITOPS_OVERLAY_PATH: ${{ inputs.gitops_overlay_path }}
+          WEB_IMAGE: ${{ env.OCIR_REGISTRY }}/${{ env.OCIR_NAMESPACE }}/${{ env.OCIR_REPOSITORY }}
+          WEB_IMAGE_TAG: ${{ env.IMAGE_TAG }}
+        run: bash .github/scripts/update-gitops-web-with-migration.sh

.github/workflows/ci.yml

@@ -40,6 +40,9 @@ jobs:
       - name: Setup Node environment
         uses: ./.github/actions/setup-node-env
 
+      - name: Generate Prisma client
+        run: pnpm --filter allclear-web prisma:generate
+
       - name: Lint, typecheck, and test
         run: pnpm verify
 
@@ -53,6 +56,9 @@ jobs:
       - name: Setup Node environment
         uses: ./.github/actions/setup-node-env
 
+      - name: Generate Prisma client
+        run: pnpm --filter allclear-web prisma:generate
+
       - name: Build web
         run: pnpm --filter allclear-web build
 

.github/workflows/deploy-web-dev.yml

@@ -6,6 +6,7 @@ on:
     types: [closed]
     paths:
       - apps/web/**
+      - apps/web-migrator/**
       - package.json
       - pnpm-lock.yaml
       - pnpm-workspace.yaml

.github/workflows/deploy-web-prod.yml

@@ -6,6 +6,7 @@ on:
     types: [closed]
     paths:
       - apps/web/**
+      - apps/web-migrator/**
       - package.json
       - pnpm-lock.yaml
       - pnpm-workspace.yaml
@@ -14,6 +15,8 @@ on:
       - .dockerignore
       - .github/workflows/_deploy-web.yml
       - .github/workflows/deploy-web-prod.yml
+      - .github/gitops/allclear-prod-prisma-migrate.yaml
+      - .github/scripts/update-gitops-web-with-migration.sh
 
 jobs:
   deploy:
@@ -22,6 +25,7 @@ jobs:
     with:
       ocir_repository: allclear-prod/allclear-web
       gitops_overlay_path: argocd/allclear-prod
+      run_prisma_migrations: true
     secrets:
       OCI_AUTH_TOKEN: ${{ secrets.OCI_AUTH_TOKEN }}
       DEPLOYER_APP_PRIVATE_KEY: ${{ secrets.DEPLOYER_APP_PRIVATE_KEY }}

.github/workflows/verify-web-image.yml

@@ -0,0 +1,51 @@
+name: Verify web image
+
+on:
+  pull_request:
+    branches: [develop, main]
+    paths:
+      - apps/web/**
+      - apps/web-migrator/**
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
+      - turbo.json
+      - biome.json
+      - .dockerignore
+      - .github/workflows/_deploy-web.yml
+      - .github/workflows/deploy-web-prod.yml
+      - .github/gitops/allclear-prod-prisma-migrate.yaml
+      - .github/scripts/update-gitops-web-with-migration.sh
+      - .github/workflows/verify-web-image.yml
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-validate:
+    runs-on: ubuntu-24.04-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5.0.1
+
+      - name: Build ARM64 web image
+        run: |
+          docker build \
+            --file apps/web/Dockerfile \
+            --platform linux/arm64 \
+            --tag allclear-web:prisma-verify \
+            .
+
+      - name: Validate Prisma migration runner
+        run: |
+          docker run --rm \
+            --platform linux/arm64 \
+            --workdir /app/prisma-migrator \
+            --entrypoint /app/prisma-migrator/node_modules/.bin/prisma \
+            allclear-web:prisma-verify \
+            validate

README.md

@@ -24,6 +24,12 @@ pnpm android:debug
 
 환경 변수 파일은 저장소에 포함하지 않습니다. 각 앱의 `.env.example`을 복사해 로컬 환경에 맞게 설정하세요.
 
+웹 서버는 Prisma Client로 PostgreSQL에 연결합니다. 의존성을 설치한 직후나
+`apps/web/prisma/schema.prisma`를 변경한 뒤에는 저장소 루트에서
+`pnpm --dir apps/web prisma:generate`를 실행하세요. 평소에는 생성된 Client가 있으면
+`pnpm dev:web`만 실행하면 됩니다. 웹 빌드는 Client를 자동 생성하며, Client 생성은
+DB 스키마를 변경하지 않습니다. DB 변경은 별도의 Prisma migration으로 관리합니다.
+
 ## 검사
 
 ```bash

apps/web-migrator/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "allclear-web-migrator",
+  "version": "1.0.0",
+  "private": true,
+  "dependencies": {
+    "dotenv": "16.6.1",
+    "prisma": "7.10.0"
+  }
+}

apps/web/.gitignore

@@ -296,4 +296,7 @@ oci-migration.md
 oci-vault-secrets.md
 
 
-.codex
+.codex
+
+# Prisma Client is generated during build and CI.
+server/infra/database/generated/prisma/

apps/web/Dockerfile

@@ -15,8 +15,20 @@ WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY apps/mobile/package.json ./apps/mobile/package.json
 COPY apps/web/package.json ./apps/web/package.json
+COPY apps/web-migrator/package.json ./apps/web-migrator/package.json
 RUN pnpm install --frozen-lockfile
 
+# --- Prisma migration tools ---
+FROM base AS migrator
+WORKDIR /app
+RUN apk add --no-cache openssl
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/mobile/package.json ./apps/mobile/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY apps/web-migrator/package.json ./apps/web-migrator/package.json
+RUN pnpm --filter allclear-web-migrator install --frozen-lockfile
+RUN pnpm --filter allclear-web-migrator deploy --prod --legacy /prisma-migrator
+
 # --- Build ---
 FROM base AS builder
 WORKDIR /app
@@ -35,12 +47,18 @@ ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 
+RUN apk add --no-cache openssl
+
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 
 COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
 COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=migrator --chown=nextjs:nodejs /prisma-migrator ./prisma-migrator
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/prisma ./prisma-migrator/prisma
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/prisma.config.ts ./prisma-migrator/prisma.config.ts
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/server/infra/database/prisma-url.ts ./prisma-migrator/server/infra/database/prisma-url.ts
 
 USER nextjs
 

apps/web/README.md

@@ -13,13 +13,17 @@
 ## 처음 프로젝트 환경 셋업하기
 
 ```Bash
-git clone https://github.com/pado-corp/clubhouse-web.git
-cd clubhouse-web
+git clone https://github.com/wafflestudio/allclear.git
+cd allclear
 pnpm install
-pnpm husky install
-pnpm dev
+pnpm --dir apps/web prisma:generate
+pnpm dev:web
 ```
 
+위 명령은 저장소 루트에서 실행합니다. 이후에는 Prisma 스키마가 바뀌거나
+`node_modules`를 다시 설치한 경우에만 `prisma:generate`를 다시 실행하면 됩니다.
+`pnpm dev:web`은 DB migration을 실행하지 않습니다.
+
 ## 기술 스택 
 
 ### 언어 / 프레임워크