fix(identity): treat CLA as signed across username/github/public-id a… #444
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mono Engine deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/mono-engine-deploy.yml" | |
| - "api-model/**" | |
| - "ceres/**" | |
| - "common/**" | |
| - "context/**" | |
| - "io-orbit/**" | |
| - "jupiter/**" | |
| - "mono/**" | |
| - "saturn/**" | |
| - "vault/**" | |
| - "Cargo.toml" | |
| env: | |
| REGISTRY_ALIAS: m8q5m4u3 | |
| REPOSITORY: mega/mono-engine | |
| IMAGE_TAG_BASE: latest | |
| HARBOR_REGISTRY: registry.xuanwu.openatom.cn | |
| # TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore. | |
| PUSH_AWS_ECR: "false" | |
| # Using AWS access key for authentication. | |
| # actions: write is required for docker buildx --cache-{from,to} type=gha. | |
| permissions: | |
| id-token: write | |
| contents: read | |
| actions: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-push-single-arch: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw | |
| # `docker buildx --cache-{from,to} type=gha` in the build step. | |
| - name: Expose GitHub Actions runtime env | |
| uses: crazy-max/ghaction-github-runtime@v3 | |
| # ----------------------------- | |
| # AWS / ECR Public (TEMP disabled) | |
| # ----------------------------- | |
| - name: Configure AWS Credentials | |
| if: env.PUSH_AWS_ECR == 'true' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| if: env.PUSH_AWS_ECR == 'true' | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| # ----------------------------- | |
| # Build & push (Harbor; ECR when PUSH_AWS_ECR=true) | |
| # ----------------------------- | |
| - name: Build & push image (amd64) | |
| env: | |
| ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| IMAGE_TAG_BASE: ${{ env.IMAGE_TAG_BASE }} | |
| PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }} | |
| run: | | |
| set -euo pipefail | |
| ARCH_SUFFIX=amd64 | |
| IMAGE_TAG="${IMAGE_TAG_BASE}-${ARCH_SUFFIX}" | |
| HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| CACHE_SCOPE="mono-engine-${ARCH_SUFFIX}" | |
| TAGS=(-t "$HARBOR_IMAGE") | |
| if [ "$PUSH_AWS_ECR" = "true" ]; then | |
| ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| echo "ECR_IMAGE=$ECR_IMAGE" | |
| TAGS+=(-t "$ECR_IMAGE") | |
| else | |
| echo "TEMP: skipping AWS ECR push (Harbor only)" | |
| fi | |
| echo "HARBOR_IMAGE=$HARBOR_IMAGE" | |
| echo "CACHE_SCOPE=$CACHE_SCOPE" | |
| docker buildx build \ | |
| --cache-from type=gha,scope=$CACHE_SCOPE \ | |
| --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \ | |
| --provenance=false \ | |
| --sbom=false \ | |
| -f ./mono/Dockerfile \ | |
| "${TAGS[@]}" \ | |
| --push . | |
| manifest: | |
| needs: build-push-single-arch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Configure AWS Credentials | |
| if: env.PUSH_AWS_ECR == 'true' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| if: env.PUSH_AWS_ECR == 'true' | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| - name: Create & push manifest | |
| env: | |
| REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }} | |
| run: | | |
| set -euo pipefail | |
| HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}" | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| TAG_BASE="${{ env.IMAGE_TAG_BASE }}" | |
| push_manifests() { | |
| local base="$1" | |
| local refs=("$base:${TAG_BASE}-amd64") | |
| if docker manifest inspect "$base:${TAG_BASE}-arm64" >/dev/null 2>&1; then | |
| refs+=("$base:${TAG_BASE}-arm64") | |
| else | |
| echo "WARN: $base:${TAG_BASE}-arm64 not found; publishing amd64-only manifests" | |
| fi | |
| docker manifest create "$base:${TAG_BASE}" "${refs[@]}" | |
| docker manifest push "$base:${TAG_BASE}" | |
| docker manifest create "$base:$SHORT_SHA" "${refs[@]}" | |
| docker manifest push "$base:$SHORT_SHA" | |
| } | |
| if [ "$PUSH_AWS_ECR" = "true" ]; then | |
| IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}" | |
| push_manifests "$IMAGE_BASE" | |
| else | |
| echo "TEMP: skipping AWS ECR manifests (Harbor only)" | |
| fi | |
| push_manifests "$HARBOR_BASE" | |
| deploy-aws: | |
| needs: manifest | |
| if: false # disabled | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| include: | |
| - cluster: gitmega-com | |
| service: mono-engine-dev-service-xnmoxhxb | |
| - cluster: gitmono-com-mega-app | |
| service: mono-engine | |
| steps: | |
| - name: Force ECS redeploy | |
| run: | | |
| aws ecs update-service \ | |
| --cluster ${{ matrix.cluster }} \ | |
| --service ${{ matrix.service }} \ | |
| --force-new-deployment | |
| env: | |
| AWS_REGION: ap-southeast-2 | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |