push-ingestor-build.yaml

name: Build and push ingestor to remote

on:
  push:
    branches:
      - main
    paths:
      - "ingestion_tools/**"
      - "apiv2/**"
      - ".github/workflows/push-ingestor-build.yaml"

# https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
permissions:
  id-token: write
  contents: read

jobs:
  push-images:
    strategy:
      matrix:
        include:
          - build_dir: ingestion_tools
            repo_key: ECR_REPO
          - build_dir: apiv2
            repo_key: ECR_REPO_V2
    name: build and push ingestor to remote
    runs-on: ubuntu-latest
    environment: staging
    if: github.repository == 'chanzuckerberg/cryoet-data-portal-backend'
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          mask-aws-account-id: true
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-duration-seconds: 1200
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Docker build & Push
        uses: docker/build-push-action@v4
        with:
          context: ./${{ matrix.build_dir }}
          file: ./${{ matrix.build_dir }}/Dockerfile
          tags: ${{ secrets[matrix.repo_key] }}:${{ github.head_ref || github.ref_name }}
          push: true
          provenance: false