chore(ci): publish to Velocity ECR via OIDC, drop kubectl rollout

.github/workflows/velocity-publish.yml

@@ -0,0 +1,118 @@
+# Velocity ECR publishing — tag-driven. Push a vX.Y.Z tag and this builds
+# the tagged commit and pushes keep-rs:vX.Y.Z to Velocity ECR. Tags there
+# are IMMUTABLE: a published version can never be overwritten —
+# re-releasing means a new tag. Deploying a version is a separate PR in
+# drift-labs/infrastructure-v3 bumping the gitops image pin.
+#
+# NOTE: the drift-rs / protocol-v2-shadow sibling checkouts track floating
+# refs (next / master), so rebuilding the same tag later may not be
+# bit-identical — but immutability means a published version is never
+# rebuilt anyway.
+#
+# Every version lands in non-prod ECR; the prod-copy steps below are
+# commented out until the prod account exists.
+# The branch-push workflows (master.yml / mainnet-beta.yml) still deploy
+# the OLD drift infra and are untouched; this is the only Velocity path.
+name: Publish Velocity ECR (release tag)
+
+on:
+  push:
+    tags: ['v*']
+
+env:
+  # drift-rs + protocol-v2-shadow (the `drift` crate) are path-dep siblings of
+  # keep-rs; the docker build context is the parent dir holding all three.
+  DRIFT_RS_REF: next
+  SHADOW_REF: master
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubicloud
+    steps:
+      - name: Checkout keep-rs
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          path: keep-rs
+
+      - name: Checkout drift-rs
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: drift-labs/drift-rs
+          ref: ${{ env.DRIFT_RS_REF }}
+          path: drift-rs
+
+      - name: Generate protocol-v2-shadow read token
+        id: shadow-token
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        with:
+          app-id: ${{ vars.VELOCITY_SDK_READER_APP_ID }}
+          private-key: ${{ secrets.VELOCITY_SDK_READER_PRIVATE_KEY }}
+          owner: drift-labs
+          repositories: protocol-v2-shadow
+
+      - name: Checkout protocol-v2-shadow
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: drift-labs/protocol-v2-shadow
+          ref: ${{ env.SHADOW_REF }}
+          token: ${{ steps.shadow-token.outputs.token }}
+          path: protocol-v2-shadow
+
+      - name: Configure AWS credentials (non-prod)
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          role-to-assume: ${{ vars.VELOCITY_NON_PROD_ECR_PUBLISH_ROLE }}
+          role-session-name: gha-${{ github.run_id }}
+          aws-region: eu-west-1
+
+      - name: Log in to Amazon ECR (non-prod)
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        with:
+          version: v0.10.0
+
+      - name: Docker build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: keep-rs
+          IMAGE_TAG: ${{ github.ref_name }}
+        with:
+          context: .
+          file: keep-rs/Dockerfile
+          push: true
+          tags: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
+
+      # Prod copy — disabled until the prod account + publish role exist;
+      # uncomment when VELOCITY_PROD_ECR_PUBLISH_ROLE is set.
+      # - name: Configure AWS credentials (prod)
+      #   if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != ''
+      #   uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      #   with:
+      #     role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }}
+      #     role-session-name: gha-${{ github.run_id }}
+      #     aws-region: eu-west-1
+
+      # - name: Log in to Amazon ECR (prod)
+      #   if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != ''
+      #   id: login-ecr-prod
+      #   uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4
+
+      # - name: Copy image to prod ECR
+      #   if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != ''
+      #   env:
+      #     NONPROD_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+      #     PROD_REGISTRY: ${{ steps.login-ecr-prod.outputs.registry }}
+      #     ECR_REPOSITORY: keep-rs
+      #     IMAGE_TAG: ${{ github.ref_name }}
+      #   run: |
+      #     docker buildx imagetools create \
+      #       -t "$PROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" \
+      #       "$NONPROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"