@@ -0,0 +1,73 @@
+name: Mono Engine deploy
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mono-engine-deploy.yml"
+      - "src/**"
+      - "config/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "Dockerfile"
+      - ".dockerignore"
+
+env:
+  REPOSITORY: mega2/mega2
+  IMAGE_TAG_BASE: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
+
+# actions: write is required for docker buildx --cache-{from,to} type=gha.
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw
+      # `docker buildx --cache-{from,to} type=gha` in the build step.
+      - name: Expose GitHub Actions runtime env
+        uses: crazy-max/ghaction-github-runtime@v3
+
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Build & push image
+        run: |
+          set -euo pipefail
+
+          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+          TAG_BASE="${{ env.IMAGE_TAG_BASE }}"
+          CACHE_SCOPE="mega2-amd64"
+
+          echo "HARBOR_IMAGE=$HARBOR_BASE:$TAG_BASE"
+          echo "HARBOR_SHA=$HARBOR_BASE:$SHORT_SHA"
+          echo "CACHE_SCOPE=$CACHE_SCOPE"
+
+          docker buildx build \
+            --cache-from type=gha,scope=$CACHE_SCOPE \
+            --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \
+            --provenance=false \
+            --sbom=false \
+            -f ./Dockerfile \
+            -t "$HARBOR_BASE:$TAG_BASE" \
+            -t "$HARBOR_BASE:$SHORT_SHA" \
+            --push .