manual_deploy_faktory.yml

name: Manual Deployment (Faktory)

on:
  workflow_dispatch:
    inputs:
      env:
        required: true
        default: dev
        type: choice
        description: Environment to deploy to
        options:
          - dev
          - test
          - impl
          - prod
      confirm_production_deploy:
        required: true
        default: false
        type: boolean
        description: Confirm that you want to deploy to production

permissions:
  id-token: write
  contents: read

env:
  GIT_HASH: ${{ github.sha }}
  GIT_REF_NAME: ${{ github.ref }}
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

jobs:
  build_faktory_image:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          registry: docker.contribsys.com
          username: ${{ secrets.CONTRIBSYS_REPO_USERNAME }}
          password: ${{ secrets.CONTRIBSYS_REPO_PASSWORD }}
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          role-to-assume: ${{ secrets.INFRA_ROLE_TO_ASSUME }}
          aws-region: us-east-1
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: Build and push
        uses: docker/build-push-action@v6
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: mint-faktory
        with:
          push: true
          tags: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.GIT_HASH }}
          file: "Dockerfile.faktory"
          platforms: "linux/amd64"
          context: .
          cache-to: type=gha,scope=${{ env.GIT_REF_NAME }}-faktory
          cache-from: type=gha,mode=max,scope=${{ env.GIT_REF_NAME }}-faktory
          # As of Buildx verion 0.10, image are build with provenance by default.
          # Lambda currently does not support functions that use multi-architecture container images (https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-reqs)
          # As such, the Lambda for vulnerability scanning will fail if the image is built with provenance.
          # More information can be found here: https://github.com/docker/buildx/issues/1533
          provenance: false

  deploy_faktory:
    needs: [build_faktory_image]
    runs-on: ubuntu-latest
    steps:
      - name: Deploy Faktory ECS service
        env:
          ECR_REGISTRY: ${{ secrets.ECR_REGISTRY }}
          ECR_REPOSITORY: mint-faktory
          NEW_IMAGE_TAG: ${{ env.GIT_HASH }}
          TASK_FAMILY: "mint-faktory-${{ inputs.env }}"
          ECS_CLUSTER: "${{ inputs.env }}-mint-faktory"
          SERVICE_NAME: mint-faktory
        run: |
          export TASK_REVISION=$(./scripts/update_ecs_task_definition.sh)
          ./scripts/deploy_ecs_service.sh