fix orion build issues (#2151) #433
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mono Engine deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/mono-engine-deploy.yml" | |
| - "api-model/**" | |
| - "ceres/**" | |
| - "common/**" | |
| - "context/**" | |
| - "io-orbit/**" | |
| - "jupiter/**" | |
| - "mono/**" | |
| - "saturn/**" | |
| - "vault/**" | |
| - "Cargo.toml" | |
| env: | |
| REGISTRY_ALIAS: m8q5m4u3 | |
| REPOSITORY: mega/mono-engine | |
| IMAGE_TAG_BASE: latest | |
| HARBOR_REGISTRY: registry.xuanwu.openatom.cn | |
| # Using AWS access key for authentication. | |
| # actions: write is required for docker buildx --cache-{from,to} type=gha. | |
| permissions: | |
| id-token: write | |
| contents: read | |
| actions: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-push-single-arch: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw | |
| # `docker buildx --cache-{from,to} type=gha` in the build step. | |
| - name: Expose GitHub Actions runtime env | |
| uses: crazy-max/ghaction-github-runtime@v3 | |
| # ----------------------------- | |
| # AWS / ECR Public | |
| # ----------------------------- | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| # ----------------------------- | |
| # Build & push to ECR + Harbor | |
| # ----------------------------- | |
| - name: Build & push image to ECR and Harbor (amd64) | |
| env: | |
| ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| IMAGE_TAG_BASE: ${{ env.IMAGE_TAG_BASE }} | |
| run: | | |
| set -euo pipefail | |
| ARCH_SUFFIX=amd64 | |
| IMAGE_TAG="${IMAGE_TAG_BASE}-${ARCH_SUFFIX}" | |
| ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| CACHE_SCOPE="mono-engine-${ARCH_SUFFIX}" | |
| echo "ECR_IMAGE=$ECR_IMAGE" | |
| echo "HARBOR_IMAGE=$HARBOR_IMAGE" | |
| echo "CACHE_SCOPE=$CACHE_SCOPE" | |
| docker buildx build \ | |
| --cache-from type=gha,scope=$CACHE_SCOPE \ | |
| --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \ | |
| --provenance=false \ | |
| --sbom=false \ | |
| -f ./mono/Dockerfile \ | |
| -t "$ECR_IMAGE" \ | |
| -t "$HARBOR_IMAGE" \ | |
| --push . | |
| manifest: | |
| needs: build-push-single-arch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| - name: Create & push manifest | |
| env: | |
| REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| run: | | |
| set -euo pipefail | |
| IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}" | |
| HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}" | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| TAG_BASE="${{ env.IMAGE_TAG_BASE }}" | |
| push_manifests() { | |
| local base="$1" | |
| local refs=("$base:${TAG_BASE}-amd64") | |
| if docker manifest inspect "$base:${TAG_BASE}-arm64" >/dev/null 2>&1; then | |
| refs+=("$base:${TAG_BASE}-arm64") | |
| else | |
| echo "WARN: $base:${TAG_BASE}-arm64 not found; publishing amd64-only manifests" | |
| fi | |
| docker manifest create "$base:${TAG_BASE}" "${refs[@]}" | |
| docker manifest push "$base:${TAG_BASE}" | |
| docker manifest create "$base:$SHORT_SHA" "${refs[@]}" | |
| docker manifest push "$base:$SHORT_SHA" | |
| } | |
| push_manifests "$IMAGE_BASE" | |
| push_manifests "$HARBOR_BASE" | |
| deploy-aws: | |
| needs: manifest | |
| if: false # disabled | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| include: | |
| - cluster: gitmega-com | |
| service: mono-engine-dev-service-xnmoxhxb | |
| - cluster: gitmono-com-mega-app | |
| service: mono-engine | |
| steps: | |
| - name: Force ECS redeploy | |
| run: | | |
| aws ecs update-service \ | |
| --cluster ${{ matrix.cluster }} \ | |
| --service ${{ matrix.service }} \ | |
| --force-new-deployment | |
| env: | |
| AWS_REGION: ap-southeast-2 | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |