ci-recording-rasterizer-container.yml

name: Build and deploy recording-rasterizer container image

on:
    workflow_dispatch:
    pull_request:
    merge_group:
    push:
        branches:
            - 'master'

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
    changes:
        runs-on: ubuntu-24.04
        permissions:
            contents: read
            pull-requests: read
        timeout-minutes: 5
        if: github.repository == 'PostHog/posthog' && github.event_name != 'merge_group'
        name: Determine need to run recording-rasterizer Docker build
        outputs:
            rasterizer_files: ${{ steps.filter.outputs.rasterizer_files }}
        steps:
            - name: Check out
              uses: actions/checkout@v6

            - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
              id: filter
              with:
                  filters: |
                      rasterizer_files:
                        - 'nodejs/**'
                        - 'common/hogvm/typescript/**'
                        - 'common/plugin_transpiler/**'
                        - 'common/esbuilder/**'
                        - 'common/replay-shared/**'
                        - 'common/replay-headless/**'
                        - 'rust/cyclotron-node/**'
                        - 'rust/cyclotron-core/**'
                        - 'Dockerfile.recording-rasterizer'
                        - '.github/workflows/ci-recording-rasterizer-container.yml'
                        - 'bin/turbo'
                        - 'patches/**'
                        - 'turbo.json'
                        - 'tsconfig.json'
                        - 'package.json'
                        - 'pnpm-lock.yaml'
                        - 'pnpm-workspace.yaml'

    build:
        needs: changes
        name: Build and push recording-rasterizer image
        if: |
            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.changes.outputs.rasterizer_files == 'true') ||
            github.event_name == 'merge_group' ||
            github.event_name == 'workflow_dispatch' ||
            (github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.rasterizer_files == 'true')
        runs-on: depot-ubuntu-latest
        timeout-minutes: 30
        permissions:
            id-token: write # allow issuing OIDC tokens for this workflow run
            contents: read # allow reading the repo contents
            packages: write # allow push to ghcr.io

        outputs:
            digest: ${{ steps.build.outputs.digest }}

        steps:
            - name: Check out
              uses: actions/checkout@v6

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

            - name: Set up QEMU
              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

            - name: Set up Depot CLI
              uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0

            - name: Docker meta and registry login
              id: docker-meta
              uses: ./.github/actions/docker-meta
              with:
                  image-name: posthog-recording-rasterizer
                  aws-role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  dockerhub-username: ${{ secrets.DOCKERHUB_USER }}
                  dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Build and push container image
              id: build
              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
              with:
                  context: .
                  buildx-fallback: false
                  project: '00mrvlsdvh'
                  push: true
                  file: Dockerfile.recording-rasterizer
                  tags: ${{ steps.docker-meta.outputs.tags }}
                  labels: ${{ steps.docker-meta.outputs.labels }}
                  platforms: linux/amd64
                  build-args: |
                      COMMIT_HASH=${{ github.sha }}

            - name: Container image digest
              env:
                  IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
                  IMAGE_REGISTRY: ${{ steps.docker-meta.outputs.ecr-registry }}
                  COMMIT_SHA: ${{ github.sha }}
              run: |
                  echo "Image digest: $IMAGE_DIGEST"
                  echo "Full image reference: $IMAGE_REGISTRY/posthog-recording-rasterizer:$COMMIT_SHA@$IMAGE_DIGEST"
                  echo "## Container image built :rocket:" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "**Image reference:** \`$IMAGE_REGISTRY/posthog-recording-rasterizer:$COMMIT_SHA@$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "**Image SHA:** \`$COMMIT_SHA@$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "- Commit: \`$COMMIT_SHA\`" >> $GITHUB_STEP_SUMMARY
                  echo "- Digest: \`$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY

            - name: Report failure
              if: failure()
              uses: PostHog/posthog-github-action@eea1405eeb2d1d2259f0ee0b44d7b152869e6840 # v1.1.1
              with:
                  posthog-token: ${{ secrets.POSTHOG_API_TOKEN }}
                  event: 'recording-rasterizer-image-build'
                  properties: '{"status": "failure", "commit_hash": "${{ github.sha }}"}'

    deploy:
        name: Deploy recording-rasterizer service
        runs-on: ubuntu-24.04
        timeout-minutes: 5
        needs: build
        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
        permissions:
            contents: read
        steps:
            - name: Check out
              uses: actions/checkout@v6

            - name: Get deployer token
              id: deployer
              uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc # v3.0.0
              with:
                  app_id: ${{ secrets.GH_APP_CHARTS_DEPLOYER_APP_ID }}
                  private_key: ${{ secrets.GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY }}

            - name: Get PR labels
              id: labels
              uses: ./.github/actions/get-pr-labels
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}

            - name: Trigger recording-rasterizer deployment
              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
              with:
                  token: ${{ steps.deployer.outputs.token }}
                  repository: PostHog/charts
                  event-type: commit_state_update
                  client-payload: |
                      {
                        "values": {
                          "image": {
                            "sha": "${{ github.sha }}@${{ needs.build.outputs.digest }}"
                          }
                        },
                        "release": "recording-rasterizer",
                        "commit": ${{ toJson(github.event.head_commit) }},
                        "repository": ${{ toJson(github.repository) }},
                        "labels": ${{ steps.labels.outputs.labels }},
                        "timestamp": "${{ github.event.head_commit.timestamp }}"
                      }