Update workflow to use a distinct action for batch jobs, and quit bui…

…lding batch images via GitLab.

.github/workflows/cd-deploy-batch.yml

@@ -0,0 +1,123 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v*'
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+
+    outputs:
+      image: ${{ steps.build-image.outputs.image }}
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v2
+      with:
+        role-to-assume: ${{ secrets.AWS_OIDC_ROLE_TO_ASSUME }}
+        aws-region: eu-west-1
+
+    - name: Login to Amazon ECR
+      id: login-ecr
+      uses: aws-actions/amazon-ecr-login@v1
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v1
+
+    - name: Cache Docker layers
+      uses: actions/cache@v2
+      id: cache
+      with:
+        path: /tmp/.buildx-cache
+        key: ${{ runner.os }}-buildx-${{ github.sha }}
+        restore-keys: |
+          ${{ runner.os }}-buildx-
+
+    - name: Docker Buildx (build)
+      id: build-image
+      env:
+        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        ECR_REPOSITORY: ${{ github.event.repository.name }}
+        IMAGE_TAG: ${{ github.sha }}
+      run: |
+        docker buildx build \
+          --cache-from "type=local,src=/tmp/.buildx-cache" \
+          --cache-to "type=local,dest=/tmp/.buildx-cache-new" \
+          --platform "linux/amd64" \
+          --load \
+          --tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG \
+          --file ./production/Dockerfile ./
+        echo "::set-output name=image::$ECR_REGISTRY/batch/check/api:$IMAGE_TAG"
+
+    - name: Docker Buildx (push)
+      id: push-image-to-ecr
+      env:
+        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        ECR_REPOSITORY: ${{ github.event.repository.name }}
+        IMAGE_TAG: ${{ github.sha }}
+      run: |
+        BRANCH=$(echo "${GITHUB_REF#refs/*/}" | sed 's/.*\///')
+        # push with git sha
+        docker buildx build \
+          --cache-from "type=local,src=/tmp/.buildx-cache" \
+          --output "type=image,push=true" \
+          --tag $ECR_REGISTRY/batch/check/api:$IMAGE_TAG \
+          --file ./Dockerfile ./
+        # push docker tag to indicate branch
+        docker buildx build \
+          --cache-from "type=local,src=/tmp/.buildx-cache" \
+          --output "type=image,push=true" \
+          --tag $ECR_REGISTRY/$ECR_REPOSITORY:$BRANCH \
+          --file ./production/Dockerfile ./
+
+    - name: Kick off Terraform deploy in sysops/
+      id: sysops-deploy-batch-qa
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/develop')
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.SYSOPS_RW_GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/meedan/sysops/actions/workflows/deploy_check_batch.yml/dispatches \
+          -d '{"ref": "master", "inputs": {"git_sha": "${{ github.sha }}", "type": "develop"}}'
+
+    - name: Kick off Terraform deploy in sysops/
+      id: sysops-deploy-batch-live
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/master')
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.SYSOPS_RW_GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/meedan/sysops/actions/workflows/deploy_check_batch.yml/dispatches \
+          -d '{"ref": "master", "inputs": {"git_sha": "${{ github.sha }}", "type": "push"}}'
+
+    - name: Kick off Terraform deploy in sysops/
+      id: sysops-deploy-batch-tag-unimplemented
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.SYSOPS_RW_GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/meedan/sysops/actions/workflows/deploy_check_batch.yml/dispatches \
+          -d '{"ref": "master", "inputs": {"git_sha": "${{ github.sha }}", "type": "tag"}}'
+
+    - name: Reset cache
+      id: reset-cache
+      if: ${{ success() || failure() }}
+      run: |
+        rm -rf /tmp/.buildx-cache
+        mv /tmp/.buildx-cache-new /tmp/.buildx-cache

.gitlab-ci.yml

@@ -55,24 +55,6 @@ deploy_qa:
   only:
     - develop
 
-build_batch:
-  image: registry.gitlab.com/gitlab-org/cloud-deploy/aws-base:latest
-  services:
-    - docker:dind
-  tags:
-    - meedan
-    - meedan-labs
-  stage: build
-  variables:
-    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
-    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
-  script:
-    - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ECR_API_BASE_URL
-    - docker build -f production/Dockerfile -t "$ECR_API_BASE_URL/batch/check/api:$CI_COMMIT_SHA" .
-    - docker push "$ECR_API_BASE_URL/batch/check/api:$CI_COMMIT_SHA"
-  only:
-    - master
-
 build_live:
   image: registry.gitlab.com/gitlab-org/cloud-deploy/aws-base:latest
   services: