deploy-cirrus.yml

name: Deploy Cirrus

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

env:
  PROJECT_ID: moz-fx-cirrus-prod
  IMAGE_BASE: us-docker.pkg.dev/moz-fx-cirrus-prod/cirrus-prod/cirrus

jobs:
  deploy:
    name: Deploy Cirrus
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-tags: true
          fetch-depth: 0

      - uses: ./.github/actions/check-changed-paths
        id: check-paths
        with:
          paths: "cirrus/ application-services/ experimenter/experimenter/features/manifests/"

      - uses: ./.github/actions/setup-cached-build
        if: steps.check-paths.outputs.should-run == 'true'

      - uses: ./.github/actions/retry
        if: steps.check-paths.outputs.should-run == 'true'
        with:
          label: Build Cirrus
          run: make cirrus_build

      - name: Generate image tag
        if: steps.check-paths.outputs.should-run == 'true'
        id: tag
        run: |
          TAG="sha-$(git rev-parse --short=9 HEAD)"
          echo "image_tag=${TAG}" >> "$GITHUB_OUTPUT"

      - name: Tag image for GAR
        if: steps.check-paths.outputs.should-run == 'true'
        env:
          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
        run: |
          docker tag cirrus:deploy "${IMAGE_BASE}:latest"
          docker tag cirrus:deploy "${IMAGE_BASE}:${IMAGE_TAG}"

      - name: Push to Google Artifact Registry
        if: steps.check-paths.outputs.should-run == 'true'
        uses: mozilla-it/deploy-actions/docker-push@e2876aeb0f458eba1a39fa46bd072264c5877b11 # v4.3.2
        with:
          image_tags: |-
            ${{ env.IMAGE_BASE }}:latest
            ${{ env.IMAGE_BASE }}:${{ steps.tag.outputs.image_tag }}
          workload_identity_pool_project_number: ${{ vars.GCPV2_WORKLOAD_IDENTITY_POOL_PROJECT_NUMBER }}
          project_id: ${{ env.PROJECT_ID }}