InferenceSystem-deploy.yaml

---
name: InferenceSystem-deploy

on:
  workflow_dispatch:
    inputs:
      andrews-bay:
        description: 'Deploy to andrews-bay'
        type: boolean
        default: false
      bush-point:
        description: 'Deploy to bush-point'
        type: boolean
        default: false
      mast-center:
        description: 'Deploy to mast-center'
        type: boolean
        default: false
      north-sjc:
        description: 'Deploy to north-sjc'
        type: boolean
        default: false
      orcasound-lab:
        description: 'Deploy to orcasound-lab'
        type: boolean
        default: false
      point-robinson:
        description: 'Deploy to point-robinson'
        type: boolean
        default: false
      port-townsend:
        description: 'Deploy to port-townsend'
        type: boolean
        default: false
      sunset-bay:
        description: 'Deploy to sunset-bay'
        type: boolean
        default: false
      release_tag:
        description: 'Container release version, e.g. v2.2.0'
        required: true

concurrency:
  group: inference-system-publish-${{ inputs.release_tag }}
  cancel-in-progress: false
  queue: max

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  publish:
    name: Publish image
    outputs:
      namespaces: ${{ steps.locations.outputs.namespaces }}
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME: live-inference-system
      ACR_REGISTRY: orcaconservancycr.azurecr.io
    steps:
      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
        with:
          egress-policy: audit

      - name: Select deployment locations
        id: locations
        env:
          RELEASE_INPUTS: ${{ toJSON(inputs) }}
        run: |
          set -euo pipefail
          namespaces=$(jq -c 'to_entries | map(select(.value == true) | .key)' <<< "$RELEASE_INPUTS")
          if [ "$namespaces" = '[]' ]; then
            echo "Select at least one hydrophone location" >&2
            exit 1
          fi
          printf 'namespaces=%s\n' "$namespaces" >> "$GITHUB_OUTPUT"
          printf 'Selected locations: `%s`\n' "$namespaces" >> "$GITHUB_STEP_SUMMARY"

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ github.sha }}

      - name: Validate release version
        env:
          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          set -euo pipefail
          release_tag=$INPUT_RELEASE_TAG
          [[ "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
            echo "Enter a release version in vX.Y.Z format, such as v2.2.0" >&2
            exit 1
          }
          printf 'RELEASE_TAG=%s\n' "$release_tag" >> "$GITHUB_ENV"

      - name: Check if ACR secrets are set
        env:
          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
        run: |
          if [ -z "$ACR_USERNAME" ] || [ -z "$ACR_PASSWORD" ]; then
            echo "ACR credentials are missing"
            exit 1
          fi

      - name: Free up disk space
        run: |
          echo "Disk space before cleanup:"
          df -h
          # Remove unnecessary packages and cached files
          sudo apt-get clean
          sudo apt-get autoremove -y
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /usr/local/.ghcup
          sudo rm -rf /usr/share/swift
          # Clean up Docker
          docker system prune -af
          echo "Disk space after cleanup:"
          df -h

      - name: Build Dockerfile image
        working-directory: InferenceSystem
        run: |
          docker build -f Dockerfile -t "$IMAGE_NAME" .

      - name: Tag image with creation date and release version
        run: |
          set -euo pipefail
          CREATED=$(docker image inspect "$IMAGE_NAME" --format='{{.Created}}')
          DATE_STRING=$(date -d "$CREATED" +"%m-%d-%Y")
          IMAGE_TAG="$ACR_REGISTRY/$IMAGE_NAME:$DATE_STRING.$RELEASE_TAG"
          docker tag "$IMAGE_NAME" "$IMAGE_TAG"
          printf 'IMAGE_TAG=%s\n' "$IMAGE_TAG" >> "$GITHUB_ENV"

      - name: Docker login to ACR
        env:
          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
        run: |
          printf '%s' "$ACR_PASSWORD" | docker login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin

      - name: Push docker container to ACR
        run: |
          set -euo pipefail
          docker push "$IMAGE_TAG" | tee "$RUNNER_TEMP/inference-push.log"

      - name: Record published image
        run: |
          set -euo pipefail
          # Use this push's digest; another publish could overwrite the tag.
          digest=$(sed -nE 's/^.*: digest: (sha256:[a-f0-9]{64}) size: [0-9]+.*$/\1/p' "$RUNNER_TEMP/inference-push.log")
          [[ "$digest" =~ ^sha256:[a-f0-9]{64}$ ]]
          image="$IMAGE_TAG@$digest"
          printf '%s\n' "$image" > "$RUNNER_TEMP/inference-image.txt"
          printf 'Published image: `%s`\n' "$image" >> "$GITHUB_STEP_SUMMARY"
          printf 'Review this image, then approve the production deployment in this run.\n' >> "$GITHUB_STEP_SUMMARY"

      - name: Upload release metadata
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: inference-release
          path: ${{ runner.temp }}/inference-image.txt
          retention-days: 30
          if-no-files-found: error
          overwrite: true

  deploy:
    name: Deploy ${{ matrix.namespace }} after approval
    needs: publish
    strategy:
      fail-fast: false
      matrix:
        namespace: ${{ fromJSON(needs.publish.outputs.namespaces) }}
    permissions:
      actions: read
      contents: read
    uses: ./.github/workflows/InferenceSystem-deploy-aks.yaml
    with:
      namespace: ${{ matrix.namespace }}
    secrets:
      KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
      ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
      ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}