cd-runtime.yml

name: cd-runtime
on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'environment'
        required: true
        default: 'stage'
        type: choice
        options:
          - stage
          - prod
      releasetag:
        description: 'releasetag'
        required: true
        type: string
  push:
    branches:
      - main
env:
  GOPRIVATE: "github.com/dgraph-io/*,github.com/gohypermode/*"
permissions:
  id-token: write   # This is required for requesting the JWT
  contents: read    # This is required for actions/checkout
jobs:
  runtime-build-push:
    if: ${{ github.event_name == 'push' }}
    environment: stage
    runs-on: ubuntu-20.04
    steps:
      - name: Configure git for private modules
        env:
          TOKEN: ${{ secrets.GO_PRIVATE_MODULES }}
        run: git config --global url."https://admin-hypermode:${TOKEN}@github.com".insteadOf "https://github.com"
      - uses: actions/checkout@v4
      - name: Get Go Version
        run: |
          #!/bin/bash
          GOVERSION=$({ [ -f .go-version ] && cat .go-version; })
          echo "GOVERSION=$GOVERSION" >> $GITHUB_ENV
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - name: Runtime Git SHA
        run: |
          RUNTIME_GIT_SHA=$(git rev-parse --short HEAD)
          echo "runtime git sha "$RUNTIME_GIT_SHA
          echo "RUNTIME_GIT_SHA=$RUNTIME_GIT_SHA" >> $GITHUB_ENV
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: '${{ vars.AWS_ROLE }}'
          role-session-name: CD_RUNTIME
          aws-region: '${{ vars.AWS_REGION }}'
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
      - name: Make and push runtime docker image
        run: |
          docker buildx create --name multiarch_builder --driver docker-container --use --bootstrap
          # see https://github.com/docker/build-push-action/issues/755 for why provenance=false
          docker buildx build --push --provenance=false \
          --platform linux/amd64,linux/arm64 \
          --tag ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/runtime:main-${{ env.RUNTIME_GIT_SHA }} \
          --tag ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/runtime:latest \
          .
  runtime-build-workflow-dispatch:
    if: ${{ github.event_name == 'workflow_dispatch' }}
    environment: '${{ github.event.inputs.environment }}'
    runs-on: ubuntu-20.04
    steps:
      - name: Configure git for private modules
        env:
          TOKEN: ${{ secrets.GO_PRIVATE_MODULES }}
        run: git config --global url."https://admin-hypermode:${TOKEN}@github.com".insteadOf "https://github.com"
      - uses: actions/checkout@v4
        with:
          ref: '${{ github.event.inputs.releasetag }}'
      - name: Get Go Version
        run: |
          #!/bin/bash
          GOVERSION=$({ [ -f .go-version ] && cat .go-version; })
          echo "GOVERSION=$GOVERSION" >> $GITHUB_ENV
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - name: Set Runtime Release Version
        run: |
          #!/bin/bash
          GIT_TAG_NAME='${{ github.event.inputs.releasetag }}'
          if [[ "$GIT_TAG_NAME" == "runtime-v"* ]]; 
          then
            echo "this is a release tag"
          else
            echo "this is NOT a release tag"
            exit 1
          fi
          RUNTIME_RELEASE_VERSION=$(echo $GIT_TAG_NAME | sed 's/runtime-//')
          echo "making a new release for runtime "$RUNTIME_RELEASE_VERSION
          echo "RUNTIME_RELEASE_VERSION=$RUNTIME_RELEASE_VERSION" >> $GITHUB_ENV
      - name: Runtime Git SHA
        run: |
          RUNTIME_GIT_SHA=$(git rev-parse --short HEAD)
          echo "runtime git sha "$RUNTIME_GIT_SHA
          echo "RUNTIME_GIT_SHA=$RUNTIME_GIT_SHA" >> $GITHUB_ENV
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: '${{ vars.AWS_ROLE }}'
          role-session-name: CD_RUNTIME
          aws-region: '${{ vars.AWS_REGION }}'
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
      - name: Make and push runtime docker image
        run: |
          docker buildx create --name multiarch_builder --driver docker-container --use --bootstrap
          # see https://github.com/docker/build-push-action/issues/755 for why provenance=false
          docker buildx build --push --provenance=false \
          --platform linux/amd64,linux/arm64 \
          --tag ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/hypermode/runtime:${{ env.RUNTIME_RELEASE_VERSION }}-${{ env.RUNTIME_GIT_SHA }} \
          .