onyx/.github/workflows/release-devcontainer.yml

name: Release Devcontainer

on:
  workflow_dispatch:
    inputs:
      no_cache:
        description: "Disable build cache"
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  docker-amd64:
    runs-on:
      - runs-on
      - runner=2cpu-linux-x64
      - run-id=${{ github.run_id }}-devcontainer-amd64
    environment: deploy
    permissions:
      id-token: write
    timeout-minutes: 60
    outputs:
      digest: ${{ steps.digest.outputs.digest }}
    env:
      REGISTRY_IMAGE: onyxdotapp/onyx-devcontainer
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
          aws-region: us-east-2

      - name: Get AWS Secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
        with:
          secret-ids: |
            DOCKER_USERNAME, deploy/docker-username
            DOCKER_TOKEN, deploy/docker-token
          parse-json-secrets: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_TOKEN }}

      - name: Build and push AMD64
        id: build
        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7
        with:
          targets: devcontainer
          no-cache: ${{ inputs.no_cache }}
          set: |
            devcontainer.platform=linux/amd64
            devcontainer.tags=
            devcontainer.output=type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Extract digest
        id: digest
        env:
          METADATA: ${{ steps.build.outputs.metadata }}
        run: |
          echo "digest=$(echo "$METADATA" | jq -r '.devcontainer."containerimage.digest"')" >> "$GITHUB_OUTPUT"

  docker-arm64:
    runs-on:
      - runs-on
      - runner=2cpu-linux-arm64
      - run-id=${{ github.run_id }}-devcontainer-arm64
    environment: deploy
    permissions:
      id-token: write
    timeout-minutes: 60
    outputs:
      digest: ${{ steps.digest.outputs.digest }}
    env:
      REGISTRY_IMAGE: onyxdotapp/onyx-devcontainer
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
          aws-region: us-east-2

      - name: Get AWS Secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
        with:
          secret-ids: |
            DOCKER_USERNAME, deploy/docker-username
            DOCKER_TOKEN, deploy/docker-token
          parse-json-secrets: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_TOKEN }}

      - name: Build and push ARM64
        id: build
        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7
        with:
          targets: devcontainer
          no-cache: ${{ inputs.no_cache }}
          set: |
            devcontainer.platform=linux/arm64
            devcontainer.tags=
            devcontainer.output=type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Extract digest
        id: digest
        env:
          METADATA: ${{ steps.build.outputs.metadata }}
        run: |
          echo "digest=$(echo "$METADATA" | jq -r '.devcontainer."containerimage.digest"')" >> "$GITHUB_OUTPUT"

  merge-docker:
    needs:
      - docker-amd64
      - docker-arm64
    runs-on:
      - runs-on
      - runner=2cpu-linux-x64
      - run-id=${{ github.run_id }}-devcontainer-merge
    environment: deploy
    permissions:
      id-token: write
    timeout-minutes: 10
    env:
      REGISTRY_IMAGE: onyxdotapp/onyx-devcontainer
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
          aws-region: us-east-2

      - name: Get AWS Secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
        with:
          secret-ids: |
            DOCKER_USERNAME, deploy/docker-username
            DOCKER_TOKEN, deploy/docker-token
          parse-json-secrets: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_TOKEN }}

      - name: Create and push manifest
        env:
          AMD64_DIGEST: ${{ needs.docker-amd64.outputs.digest }}
          ARM64_DIGEST: ${{ needs.docker-arm64.outputs.digest }}
        run: |
          docker buildx imagetools create \
            -t "${REGISTRY_IMAGE}:latest" \
            "${REGISTRY_IMAGE}@${AMD64_DIGEST}" \
            "${REGISTRY_IMAGE}@${ARM64_DIGEST}"