build-r2r-docker.yml

name: Build and Publish R2R Docker Image

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to (prod/staging)'
        required: true
        type: choice
        options:
          - prod
          - staging
  push:
    branches:
      - main

env:
  REGISTRY_BASE: ragtoriches
jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      release_version: ${{ steps.version.outputs.RELEASE_VERSION }}
      registry_image: ${{ steps.version.outputs.REGISTRY_IMAGE }}
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'

      - name: Install toml package
        run: pip install toml

      - name: Determine version and registry
        id: version
        run: |
          VERSION=$(python -c "import toml; print(toml.load('py/pyproject.toml')['project']['version'])")
          RELEASE_VERSION=$VERSION

          # Set registry based on trigger type
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            if [ "${{ github.event.inputs.environment }}" == "prod" ]; then
              REGISTRY_IMAGE="${{ env.REGISTRY_BASE }}/prod"
            else
              REGISTRY_IMAGE="${{ env.REGISTRY_BASE }}/staging"
            fi
          else
            # Push to main always goes to staging
            REGISTRY_IMAGE="${{ env.REGISTRY_BASE }}/staging"
          fi

          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_OUTPUT
          echo "REGISTRY_IMAGE=$REGISTRY_IMAGE" >> $GITHUB_OUTPUT

      - name: Set matrix
        id: set-matrix
        run: |
          echo "matrix={\"include\":[{\"platform\":\"amd64\",\"runner\":\"ubuntu-latest\"},{\"platform\":\"arm64\",\"runner\":\"arm64\"}]}" >> $GITHUB_OUTPUT

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix: ${{fromJson(needs.prepare.outputs.matrix)}}
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Echo Commit Hash
        run: |
          COMMIT_HASH=$(git rev-parse HEAD)
          echo "Building commit hash: $COMMIT_HASH"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker Auth
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.RAGTORICHES_DOCKER_UNAME }}
          password: ${{ secrets.RAGTORICHES_DOCKER_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: ./py
          file: ./py/Dockerfile
          platforms: ${{ matrix.platform }}
          no-cache: true
          push: true
          tags: |
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}-${{ matrix.platform }}
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:latest-${{ matrix.platform }}
          provenance: false
          sbom: false

  create-manifest:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    steps:
      - name: Docker Auth
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.RAGTORICHES_DOCKER_UNAME }}
          password: ${{ secrets.RAGTORICHES_DOCKER_TOKEN }}

      - name: Create and push multi-arch manifest
        run: |
          docker buildx imagetools create -t ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }} \
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}-amd64 \
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}-arm64

          docker buildx imagetools create -t ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:latest \
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}-amd64 \
            ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}-arm64

      - name: Verify manifests
        run: |
          docker buildx imagetools inspect ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.release_version }}
          docker buildx imagetools inspect ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:latest

  success-check:
    needs: [create-manifest, prepare]
    runs-on: ubuntu-latest
    steps:
      - name: Always succeed
        run: exit 0

      - name: Try Deploy to Staging
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging')
        continue-on-error: true
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.STAGING_HOST }}
          username: ${{ secrets.STAGING_USERNAME }}
          key: ${{ secrets.STAGING_SSH_KEY }}
          script: |
            docker pull ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.RELEASE_VERSION }}
            docker service update --image ${{ needs.prepare.outputs.REGISTRY_IMAGE }}:${{ needs.prepare.outputs.RELEASE_VERSION }} r2r-blue_r2r