From 29f91eb7bc20719b8fe74d186b4c775add63cd2e Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Thu, 14 May 2026 15:08:58 +0530 Subject: [PATCH] ci: migrate image publish from ECR to GHCR with single-branch release policy Drops dev-ci.yaml (main->dev ECR) and prod-ci.yaml (prod branch->prod ECR). Release workflow now triggers on v* tags pushed to main and fails fast if the tag isn't reachable from main. Replaces deprecated upload-release-asset + github-script with softprops/action-gh-release. --- .github/workflows/dev-ci.yaml | 43 --------------------- .github/workflows/prod-ci.yaml | 44 ---------------------- .github/workflows/release.yml | 68 ++++++++++++++-------------------- 3 files changed, 27 insertions(+), 128 deletions(-) delete mode 100644 .github/workflows/dev-ci.yaml delete mode 100644 .github/workflows/prod-ci.yaml diff --git a/.github/workflows/dev-ci.yaml b/.github/workflows/dev-ci.yaml deleted file mode 100644 index 00a35834..00000000 --- a/.github/workflows/dev-ci.yaml +++ /dev/null @@ -1,43 +0,0 @@ -name: dev build image -on: - workflow_dispatch: - push: - branches: [ "main" ] -jobs: - goreleaser: - runs-on: ubuntu-latest - steps: - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Checkout - uses: actions/checkout@main - - - name: Create tag name - run: echo "tag=$(date +'%Y-%m-%dT%H-%M-%S')_$GITHUB_SHA" >> $GITHUB_ENV - - - name: Install AWS cli - uses: unfor19/install-aws-cli-action@master - - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: us-east-1 - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@v1 - - - name: Build and Push Agent Image - uses: docker/build-push-action@v3 - with: - platforms: linux/amd64 - context: . - file: 'Dockerfile' - push: true - tags: | - 864186153326.dkr.ecr.us-east-1.amazonaws.com/nudgebee-node-agent:${{ env.tag }} diff --git a/.github/workflows/prod-ci.yaml b/.github/workflows/prod-ci.yaml deleted file mode 100644 index d3e71c9e..00000000 --- a/.github/workflows/prod-ci.yaml +++ /dev/null @@ -1,44 +0,0 @@ -name: dev build image -on: - workflow_dispatch: - push: - branches: [ "prod" ] - -jobs: - goreleaser: - runs-on: ubuntu-latest - steps: - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Checkout - uses: actions/checkout@main - - - name: Create tag name - run: echo "tag=$(date +'%Y-%m-%dT%H-%M-%S')_$GITHUB_SHA" >> $GITHUB_ENV - - - name: Install AWS cli - uses: unfor19/install-aws-cli-action@master - - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.PROD_AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }} - aws-region: us-east-1 - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@v1 - - - name: Build and Push Agent Image - uses: docker/build-push-action@v3 - with: - context: . - platforms: linux/amd64,linux/arm64 - file: 'Dockerfile' - push: true - tags: | - 740395098545.dkr.ecr.us-east-1.amazonaws.com/nudgebee-node-agent:${{ env.tag }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d0c09b0c..f0c456d5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,9 @@ name: Release on: - release: - types: [created] + push: + tags: + - 'v*' env: REGISTRY: ghcr.io @@ -17,6 +18,17 @@ jobs: steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Verify tag is on main + run: | + git fetch origin main + if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then + echo "Tag ${GITHUB_REF} ($GITHUB_SHA) is not reachable from main." + echo "Single-branch release policy: only tags on main may be released." + exit 1 + fi - uses: docker/setup-qemu-action@v3 - uses: docker/setup-buildx-action@v3 @@ -32,9 +44,9 @@ jobs: with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | - type=ref,event=branch - type=ref,event=pr type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} - uses: docker/build-push-action@v6 with: @@ -47,47 +59,21 @@ jobs: VERSION=${{ steps.meta.outputs.version }} - name: extract amd64 binary from the image - run: | - docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} && + run: | + docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} docker cp amd64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-amd64 - name: extract arm64 binary from the image run: | - docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} && + docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} docker cp arm64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-arm64 - - name: upload amd64 binary - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Create GitHub release with binaries + uses: softprops/action-gh-release@v2 with: - upload_url: ${{ github.event.release.upload_url }} - asset_path: /tmp/coroot-node-agent-amd64 - asset_name: coroot-node-agent-amd64 - asset_content_type: application/octet-stream - - - name: upload arm64 binary - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ github.event.release.upload_url }} - asset_path: /tmp/coroot-node-agent-arm64 - asset_name: coroot-node-agent-arm64 - asset_content_type: application/octet-stream - - - uses: actions/github-script@v7 - env: - RELEASE_ID: ${{ github.event.release.id }} - with: - script: | - const { RELEASE_ID } = process.env - github.rest.repos.updateRelease({ - owner: context.repo.owner, - repo: context.repo.repo, - release_id: `${RELEASE_ID}`, - prerelease: false, - make_latest: true - }) - - + tag_name: ${{ github.ref_name }} + name: ${{ github.ref_name }} + make_latest: true + files: | + /tmp/coroot-node-agent-amd64 + /tmp/coroot-node-agent-arm64