deploy-api.yml

name: Deploy API
on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "Image tag (defaults to short git SHA)"
        required: false
        type: string
  workflow_call:
    inputs:
      image_tag:
        description: "Image tag (defaults to short git SHA)"
        required: false
        type: string

env:
  REGISTRY_ALIAS: m8q5m4u3
  REPOSITORY: mega/campsite-api
  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
  RUBY_VERSION: 3.3.4
  NODE_VERSION: 18.16.1
  BUNDLER_VERSION: 2.3.14

permissions:
  id-token: write
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Set image tag
        id: meta
        run: |
          if [ -n "${{ inputs.image_tag }}" ]; then
            IMAGE_TAG="${{ inputs.image_tag }}"
          else
            IMAGE_TAG="${GITHUB_SHA::7}"
          fi
          echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
          echo "Using image tag: ${IMAGE_TAG}"

  build-push-amd64:
    needs: prepare
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Build & push amd64 image (AWS + Harbor)
        env:
          AWS_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
        run: |
          set -euo pipefail

          AWS_IMAGE_BASE="$AWS_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
          HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"

          docker buildx build \
            --platform linux/amd64 \
            --provenance=false \
            --sbom=false \
            --build-arg RUBY_VERSION=${{ env.RUBY_VERSION }} \
            --build-arg NODE_VERSION=${{ env.NODE_VERSION }} \
            --build-arg BUNDLER_VERSION=${{ env.BUNDLER_VERSION }} \
            -f ./api/Dockerfile \
            -t "$AWS_IMAGE_BASE:${IMAGE_TAG}" \
            -t "$AWS_IMAGE_BASE:${IMAGE_TAG}-amd64" \
            -t "$AWS_IMAGE_BASE:latest-amd64" \
            -t "$HARBOR_IMAGE_BASE:${IMAGE_TAG}" \
            -t "$HARBOR_IMAGE_BASE:${IMAGE_TAG}-amd64" \
            -t "$HARBOR_IMAGE_BASE:latest-amd64" \
            --push ./api

  # Merge locally-built arm64 image (pushed separately) with CI-built amd64
  manifest:
    needs: [prepare, build-push-amd64]
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Create & push manifest lists
        env:
          REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
        run: |
          set -euo pipefail

          IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"

          push_latest() {
            local base="$1"
            local refs=("$base:latest-amd64")
            if docker manifest inspect "$base:latest-arm64" >/dev/null 2>&1; then
              refs+=("$base:latest-arm64")
            else
              echo "WARN: $base:latest-arm64 not found; publishing amd64-only latest"
            fi
            docker manifest create "$base:latest" "${refs[@]}"
            docker manifest push "$base:latest"
            echo "Pushed manifest: $base:latest"
          }

          push_tag_if_arm64() {
            local base="$1"
            if docker manifest inspect "$base:${IMAGE_TAG}-arm64" >/dev/null 2>&1; then
              docker buildx imagetools create \
                -t "$base:${IMAGE_TAG}" \
                "$base:${IMAGE_TAG}-amd64" \
                "$base:${IMAGE_TAG}-arm64"
              echo "Pushed multi-arch manifest: $base:${IMAGE_TAG}"
            else
              echo "Using amd64-only tag: $base:${IMAGE_TAG}"
              echo "Push arm64 locally to upgrade to multi-arch: ./script/demo/build-images-arm64-local.sh ${IMAGE_TAG} --push"
            fi
          }

          push_latest "$IMAGE_BASE"
          push_tag_if_arm64 "$IMAGE_BASE"

          push_latest "$HARBOR_BASE"
          push_tag_if_arm64 "$HARBOR_BASE"

  deploy-aws:
    if: ${{ github.repository == 'web3infra-foundation/campsite' }}
    needs: manifest
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - cluster: gitmega-com
            service: campsite-api-staging-service-njx3hjyx
          - cluster: gitmono-com-mega-app
            service: campsite-api-service
    steps:
      - name: Force ECS redeploy
        run: |
          aws ecs update-service \
            --cluster ${{ matrix.cluster }} \
            --service ${{ matrix.service }} \
            --force-new-deployment
        env:
          AWS_REGION: ap-southeast-2
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}