deploy-prd.yaml

name: Deploy PRD

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-prd
  cancel-in-progress: false

env:
  DOCKER_TAGS: 21gifts/api:latest

permissions:
  contents: read
  id-token: write

jobs:
  build-and-deploy:
    name: Build and deploy to PRD
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ env.DOCKER_TAGS }}
          platforms: linux/arm64
          cache-from: type=registry,ref=21gifts/api:buildcache
          cache-to: type=registry,ref=21gifts/api:buildcache,mode=max

      - name: Notify image publish endpoint
        if: github.event_name == 'push'
        env:
          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
        run: |
          set -euo pipefail
          digest_re='^sha256:[0-9a-f]{64}$'
          if [[ ! "${IMAGE_DIGEST}" =~ ${digest_re} ]]; then
            echo "::error::image digest is missing or malformed"
            exit 1
          fi
          dispatched_at="$(date -u -d '5 seconds ago' +%Y-%m-%dT%H:%M:%SZ)"
          echo "DISPATCHED_AT=${dispatched_at}" >> "$GITHUB_ENV"
          audience='https://image-published.dfxserve.com/v1/image-published'
          oidc_token="$(curl --silent --fail \
            -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${audience}" \
            | jq -er '.value' 2>/dev/null)" || {
            echo "::error::failed to request identity token"
            exit 1
          }
          if [ -z "${oidc_token}" ]; then
            echo "::error::failed to request identity token"
            exit 1
          fi
          body="$(jq -nc --arg digest "${IMAGE_DIGEST}" '{image:"21gifts/api",tag:"latest",digest:$digest}')"
          http_code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
            -X POST \
            -H "Authorization: Bearer ${oidc_token}" \
            -H "Content-Type: application/json" \
            --data "${body}" \
            "https://image-published.dfxserve.com/v1/image-published")" || {
            echo "::error::image publish request failed"
            exit 1
          }
          case "${http_code}" in
            2[0-9][0-9]) ;;
            *)
              echo "::error::image publish request failed"
              exit 1
              ;;
          esac

      - name: Notify infrastructure to pull :latest
        if: github.event_name != 'push'
        env:
          GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          DISPATCH_REPO: ${{ secrets.DISPATCH_REPO }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN}" ] || [ -z "${DISPATCH_REPO}" ]; then
            echo "::error::DISPATCH_TOKEN or DISPATCH_REPO unset — cannot deploy this image"
            exit 1
          fi
          dispatched_at="$(date -u -d '5 seconds ago' +%Y-%m-%dT%H:%M:%SZ)"
          echo "DISPATCHED_AT=${dispatched_at}" >> "$GITHUB_ENV"
          gh api "repos/${DISPATCH_REPO}/dispatches" \
            -f event_type=image-published \
            -f "client_payload[image]=21gifts/api" \
            -f "client_payload[tag]=latest" \
            -f "client_payload[sha]=${GITHUB_SHA}"

      - name: Wait for infrastructure deploy
        env:
          GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          DISPATCH_REPO: ${{ secrets.DISPATCH_REPO }}
          IMAGE: 21gifts/api
          TAG: latest
        run: bash .github/scripts/wait-for-image-published.sh