mono-engine-deploy.yml

name: Mono Engine deploy
on:
  push:
    branches:
      - main
    paths:
      - ".github/workflows/mono-engine-deploy.yml"
      - "api-model/**"
      - "ceres/**"
      - "common/**"
      - "context/**"
      - "io-orbit/**"
      - "jupiter/**"
      - "mono/**"
      - "saturn/**"
      - "vault/**"
      - "Cargo.toml"

env:
  REGISTRY_ALIAS: m8q5m4u3
  REPOSITORY: mega/mono-engine
  IMAGE_TAG_BASE: latest
  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
  # TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore.
  PUSH_AWS_ECR: "false"

# Using AWS access key for authentication.
# actions: write is required for docker buildx --cache-{from,to} type=gha.
permissions:
  id-token: write
  contents: read
  actions: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-push-single-arch:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw
      # `docker buildx --cache-{from,to} type=gha` in the build step.
      - name: Expose GitHub Actions runtime env
        uses: crazy-max/ghaction-github-runtime@v3

      # -----------------------------
      # AWS / ECR Public (TEMP disabled)
      # -----------------------------
      - name: Configure AWS Credentials
        if: env.PUSH_AWS_ECR == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        if: env.PUSH_AWS_ECR == 'true'
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      # -----------------------------
      # Build & push (Harbor; ECR when PUSH_AWS_ECR=true)
      # -----------------------------
      - name: Build & push image (amd64)
        env:
          ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          IMAGE_TAG_BASE: ${{ env.IMAGE_TAG_BASE }}
          PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
        run: |
          set -euo pipefail

          ARCH_SUFFIX=amd64
          IMAGE_TAG="${IMAGE_TAG_BASE}-${ARCH_SUFFIX}"

          HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
          CACHE_SCOPE="mono-engine-${ARCH_SUFFIX}"

          TAGS=(-t "$HARBOR_IMAGE")
          if [ "$PUSH_AWS_ECR" = "true" ]; then
            ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
            echo "ECR_IMAGE=$ECR_IMAGE"
            TAGS+=(-t "$ECR_IMAGE")
          else
            echo "TEMP: skipping AWS ECR push (Harbor only)"
          fi

          echo "HARBOR_IMAGE=$HARBOR_IMAGE"
          echo "CACHE_SCOPE=$CACHE_SCOPE"

          docker buildx build \
            --cache-from type=gha,scope=$CACHE_SCOPE \
            --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \
            --provenance=false \
            --sbom=false \
            -f ./mono/Dockerfile \
            "${TAGS[@]}" \
            --push .

  manifest:
    needs: build-push-single-arch
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Configure AWS Credentials
        if: env.PUSH_AWS_ECR == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        if: env.PUSH_AWS_ECR == 'true'
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Create & push manifest
        env:
          REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
        run: |
          set -euo pipefail
          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
          SHORT_SHA="${GITHUB_SHA:0:7}"
          TAG_BASE="${{ env.IMAGE_TAG_BASE }}"

          push_manifests() {
            local base="$1"
            local refs=("$base:${TAG_BASE}-amd64")
            if docker manifest inspect "$base:${TAG_BASE}-arm64" >/dev/null 2>&1; then
              refs+=("$base:${TAG_BASE}-arm64")
            else
              echo "WARN: $base:${TAG_BASE}-arm64 not found; publishing amd64-only manifests"
            fi

            docker manifest create "$base:${TAG_BASE}" "${refs[@]}"
            docker manifest push "$base:${TAG_BASE}"

            docker manifest create "$base:$SHORT_SHA" "${refs[@]}"
            docker manifest push "$base:$SHORT_SHA"
          }

          if [ "$PUSH_AWS_ECR" = "true" ]; then
            IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
            push_manifests "$IMAGE_BASE"
          else
            echo "TEMP: skipping AWS ECR manifests (Harbor only)"
          fi
          push_manifests "$HARBOR_BASE"

  deploy-aws:
    needs: manifest
    if: false # disabled
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - cluster: gitmega-com
            service: mono-engine-dev-service-xnmoxhxb
          - cluster: gitmono-com-mega-app
            service: mono-engine
    steps:
      - name: Force ECS redeploy
        run: |
          aws ecs update-service \
            --cluster ${{ matrix.cluster }} \
            --service ${{ matrix.service }} \
            --force-new-deployment
        env:
          AWS_REGION: ap-southeast-2
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}