build.yaml

# syntax=docker/dockerfile:1.4
name: Build and push

on:
  push:
    branches: ["eks-infrastructure","staging","main","master","production","sandbox"]

  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: registry
  EKS_CLUSTER: ce-registry-eks

concurrency:
  group: eks-cluster-image-build
  cancel-in-progress: true

jobs:
  build-and-push:
    if: ${{ github.repository_owner == 'CredentialEngine' }}
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.img.outputs.image }}

    steps:
      - name: Checkout code (with submodules)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Verify submodules present
        run: |
          git submodule status
          if [ ! -d vendor/grape-middleware-logger ]; then
            echo "Submodule vendor/grape-middleware-logger is missing" >&2
            exit 1
          fi
          ls -la vendor/grape-middleware-logger | sed -n '1,50p'


      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/github-oidc-widget
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Compute image tag (date.build)
        id: tag
        run: |
          DATE_TAG=$(date -u +%Y.%m.%d)
          BUILD_NUM=$(printf "%04d" $(( GITHUB_RUN_NUMBER % 10000 )) )
          TAG="$DATE_TAG.$BUILD_NUM"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Compute ref tag (branch name)
        id: ref
        run: |
          REF_TAG=$(echo "${GITHUB_REF_NAME}" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9._-]+#-#g')
          echo "ref_tag=$REF_TAG" >> "$GITHUB_OUTPUT"

      - name: Build Docker image (multi-stage)
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.tag.outputs.tag }}
            ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.ref.outputs.ref_tag }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Export image URI
        id: img
        run: |
          echo "image=${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.tag.outputs.tag }}" >> "$GITHUB_OUTPUT"

      - name: Notify Slack (build result)
        if: always()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          REPO: ${{ github.repository }}
          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
          BRANCH: ${{ github.ref_name }}
          IMAGE_DATE: ${{ steps.tag.outputs.tag }}
          IMAGE_BRANCH: ${{ steps.ref.outputs.ref_tag }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          if [ -z "${SLACK_WEBHOOK_URL}" ]; then
            echo "SLACK_WEBHOOK_URL not set; skipping notification";
            exit 0;
          fi
          STATUS="${{ job.status }}"
          EMOJI=✅; [ "$STATUS" = "failure" ] && EMOJI=❌
          DIGEST_TEXT="${DIGEST:-N/A}"
          DEPLOY_URL="https://github.com/${{ github.repository }}/actions/workflows/deploy.yaml"
          payload=$(jq -n \
            --arg repo "$REPO" \
            --arg branch "$BRANCH" \
            --arg tag_date "$IMAGE_DATE" \
            --arg tag_branch "$IMAGE_BRANCH" \
            --arg digest "$DIGEST_TEXT" \
            --arg run "$RUN_URL" \
            --arg status "$STATUS" \
            --arg emoji "$EMOJI" \
            --arg deploy "$DEPLOY_URL" \
            '{
              text: "\($emoji) Build \($status) for \($repo) (\($branch))",
              blocks: [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "\($emoji) Build \($status) for \($branch)",
                    "emoji": true
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {"type":"mrkdwn", "text": "*Repository:*\n\($repo)"},
                    {"type":"mrkdwn", "text": "*Branch:*\n\($branch)"},
                    {"type":"mrkdwn", "text": "*Tag (date.build):*\n\($tag_date)"},
                    {"type":"mrkdwn", "text": "*Tag (branch):*\n\($tag_branch)"},
                    {"type":"mrkdwn", "text": "*Digest:*\n\($digest)"}
                  ]
                },
                {
                  "type":"section",
                  "text":{"type":"mrkdwn","text":"<\($run)|View run>"}
                },
                {
                  "type":"section",
                  "text":{"type":"mrkdwn","text":"Ready to deploy? Launch the workflow: <\($deploy)|Deploy image>"}
                }
              ]
            }')
          curl -sS -X POST -H 'Content-type: application/json' --data "$payload" "$SLACK_WEBHOOK_URL" || true