web-deploy.yml

name: Web UI deploy
on:
  push:
    branches:
      - main
    paths:
      - ".github/workflows/web-deploy.yml"
      - "moon/apps/web/**"
      - "moon/packages/**"

env:
  TIPTAP_PRIVATE_REGISTRY_KEY: ${{ secrets.TIPTAP_PRIVATE_REGISTRY_KEY }}
  REGISTRY_ALIAS: m8q5m4u3
  REPOSITORY: mega/mega-ui
  IMAGE_VERSION: latest
  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
  # TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore.
  PUSH_AWS_ECR: "false"

# actions: write is required for docker buildx --cache-{from,to} type=gha.
permissions:
  id-token: write
  contents: read
  actions: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---------------------------------------------------------------------------
  # Build ONE environment-agnostic image.
  #
  # NEXT_PUBLIC_* values are NOT baked per environment anymore: the image is
  # built with placeholder URLs (moon/apps/web/.env.runtime) that are replaced
  # at container start by docker-entrypoint.sh using runtime env vars. Each
  # environment (ECS task definition) must supply its own NEXT_PUBLIC_* values
  # at runtime.
  # ---------------------------------------------------------------------------
  build-push:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw
      # `docker buildx --cache-{from,to} type=gha` in the build step.
      - name: Expose GitHub Actions runtime env
        uses: crazy-max/ghaction-github-runtime@v3

      - name: Configure AWS Credentials (ECR Public, us-east-1)
        if: env.PUSH_AWS_ECR == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        if: env.PUSH_AWS_ECR == 'true'
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Build & push unified image
        working-directory: moon
        env:
          ECR_PUBLIC_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          PLATFORM: linux/amd64
          PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
        run: |
          set -euo pipefail
          ARCH_SUFFIX="amd64"
          IMAGE_TAG="${IMAGE_VERSION}-${ARCH_SUFFIX}"
          SHORT_SHA="${GITHUB_SHA:0:7}"
          SHA_TAG="${SHORT_SHA}-${ARCH_SUFFIX}"

          HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
          HARBOR_IMAGE_SHA="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$SHA_TAG"

          TAGS=(-t "$HARBOR_IMAGE" -t "$HARBOR_IMAGE_SHA")
          if [ "$PUSH_AWS_ECR" = "true" ]; then
            PUBLIC_IMAGE="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
            PUBLIC_IMAGE_SHA="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$SHA_TAG"
            TAGS+=(-t "$PUBLIC_IMAGE" -t "$PUBLIC_IMAGE_SHA")
          else
            echo "TEMP: skipping AWS ECR push (Harbor only)"
          fi

          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          docker buildx build \
            --platform "$PLATFORM" \
            --build-arg TIPTAP_PRIVATE_REGISTRY_KEY="$TIPTAP_PRIVATE_REGISTRY_KEY" \
            --build-arg GIT_SHA="${GITHUB_SHA}" \
            --build-arg BUILD_TIME="${BUILD_TIME}" \
            --cache-from type=gha,scope=mega-ui \
            --cache-to type=gha,mode=max,scope=mega-ui \
            --provenance=false \
            --sbom=false \
            -f apps/web/Dockerfile \
            "${TAGS[@]}" . \
            --push

  manifest:
    needs: build-push
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Configure AWS Credentials
        if: env.PUSH_AWS_ECR == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR Public
        if: env.PUSH_AWS_ECR == 'true'
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Create & push unified manifest
        env:
          REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
        run: |
          set -euo pipefail

          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
          TAG="${IMAGE_VERSION}"
          SHORT_SHA="${GITHUB_SHA:0:7}"

          push_manifests() {
            local base="$1"
            docker manifest create "$base:$TAG" \
              "$base:${TAG}-amd64"
            docker manifest push "$base:$TAG"

            docker manifest create "$base:$SHORT_SHA" \
              "$base:${SHORT_SHA}-amd64"
            docker manifest push "$base:$SHORT_SHA"
          }

          if [ "$PUSH_AWS_ECR" = "true" ]; then
            IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
            push_manifests "$IMAGE_BASE"
          else
            echo "TEMP: skipping AWS ECR manifests (Harbor only)"
          fi
          push_manifests "$HARBOR_BASE"

  deploy-aws:
    needs: manifest
    if: false # disabled
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - cluster: gitmega-com
            service: mega-frontend-development-service-6dcihwup
          - cluster: gitmono-com-mega-app
            service: mega-ui-service
    steps:
      - name: Force ECS redeploy
        run: |
          aws ecs update-service \
            --cluster ${{ matrix.cluster }} \
            --service ${{ matrix.service }} \
            --force-new-deployment
        env:
          AWS_REGION: ap-southeast-2
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}