duckgres/.github/workflows/container-image-cd.yml at 4829eb5e5cc4477bf4ca3e4313886253857be054 · PostHog/duckgres · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
name: Container Image CD

on:
    push:
        branches:
            - main
    workflow_dispatch:

env:
    ECR_REGISTRY: 795637471508.dkr.ecr.us-east-1.amazonaws.com
    GHCR_REGISTRY: ghcr.io
    IMAGE_NAME: duckgres

jobs:
    build:
        name: Build ${{ matrix.platform }}
        if: github.repository == 'PostHog/duckgres'
        strategy:
            fail-fast: false
            matrix:
                include:
                    - platform: linux/arm64
                      runner: ubuntu-24.04-arm
                    - platform: linux/amd64
                      runner: ubuntu-24.04
        runs-on: ${{ matrix.runner }}
        permissions:
            id-token: write
            contents: read
            packages: write

        steps:
            - name: Check out
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

            - name: Configure AWS credentials
              uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
              with:
                  role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
                  aws-region: us-east-1

            - name: Login to Amazon ECR
              id: aws-ecr
              uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1

            - name: Login to GHCR
              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
              with:
                  registry: ${{ env.GHCR_REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Prepare platform slug
              id: slug
              run: echo "arch=${PLATFORM#linux/}" >> "$GITHUB_OUTPUT"
              env:
                  PLATFORM: ${{ matrix.platform }}

            - name: Build and push by digest
              id: build
              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
              with:
                  context: .
                  push: true
                  platforms: ${{ matrix.platform }}
                  tags: |
                      ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ steps.slug.outputs.arch }}
                      ${{ env.GHCR_REGISTRY }}/posthog/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ steps.slug.outputs.arch }}
                  build-args: |
                      VERSION=build-${{ github.sha }}
                      COMMIT=${{ github.sha }}
                      BUILD_TAGS=kubernetes
                  cache-from: type=gha,scope=${{ steps.slug.outputs.arch }}
                  cache-to: type=gha,mode=max,scope=${{ steps.slug.outputs.arch }}

    manifest:
        name: Create multi-arch manifest
        needs: build
        if: github.repository == 'PostHog/duckgres'
        runs-on: ubuntu-24.04
        permissions:
            id-token: write
            contents: read
            packages: write

        steps:
            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

            - name: Configure AWS credentials
              uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
              with:
                  role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
                  aws-region: us-east-1

            - name: Login to Amazon ECR
              uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1

            - name: Login to GHCR
              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
              with:
                  registry: ${{ env.GHCR_REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Create and push ECR manifest
              id: ecr-manifest
              run: |
                  docker buildx imagetools create --tag ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
                      ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64 \
                      ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64
                  digest=$(docker buildx imagetools inspect --raw ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} | sha256sum | awk '{print "sha256:"$1}')
                  echo "digest=${digest}" >> "$GITHUB_OUTPUT"

            - name: Create and push GHCR manifests
              run: |
                  for tag in "${{ github.sha }}" "latest"; do
                      docker buildx imagetools create --tag ${{ env.GHCR_REGISTRY }}/posthog/${{ env.IMAGE_NAME }}:${tag} \
                          ${{ env.GHCR_REGISTRY }}/posthog/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64 \
                          ${{ env.GHCR_REGISTRY }}/posthog/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64
                  done

            - name: Get deployer token
              id: deployer
              uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc # v3.0.0
              with:
                  app_id: ${{ secrets.GH_APP_CHARTS_DEPLOYER_APP_ID }}
                  private_key: ${{ secrets.GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY }}

            - name: Trigger deployment via Charts repo
              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
              with:
                  token: ${{ steps.deployer.outputs.token }}
                  repository: PostHog/charts
                  event-type: commit_state_update
                  client-payload: |
                      {
                        "values": {
                          "image": {
                            "sha": "${{ github.sha }}@${{ steps.ecr-manifest.outputs.digest }}"
                          }
                        },
                        "release": "duckgres",
                        "commit": ${{ toJson(github.event.head_commit) }},
                        "repository": ${{ toJson(github.repository) }},
                        "labels": [],
                        "timestamp": "${{ github.event.head_commit.timestamp }}"
                      }