media_proxy.yml

name: Media Proxy
on: push

env:
  IMAGE_TAG: ${{ github.sha }}
  ECR_REGISTRY: public.ecr.aws/somleng
  GHCR_REGISTRY: ghcr.io/somleng

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-deployment-matrix.outputs.matrix }}
      matrixLength: ${{ steps.set-deployment-matrix.outputs.matrixLength }}
      packageMatrix: ${{ steps.set-deployment-matrix.outputs.packageMatrix }}

    steps:
      - name: Set Deployment Matrix
        id: set-deployment-matrix
        run: |
          branchName=$(echo '${{ github.ref }}' | sed 's,refs/heads/,,g')
          matrixSource=$(cat << EOF
          [
            {
              "identifier": "media-proxy-staging",
              "branch": "upgrade-media-proxy",
              "image_tag": "staging",
              "ecs_service": "media-proxy-staging",
              "ecs_cluster": "somleng-switch-staging"
            },
            {
              "identifier": "media-proxy",
              "branch": "master",
              "image_tag": "latest",
              "ecs_service": "media-proxy",
              "ecs_cluster": "somleng-switch"
            }
          ]
          EOF
          )
          matrix=$(echo $matrixSource | jq --arg branchName "$branchName" 'map(. | select((.branch==$branchName)) )')
          echo "matrix={\"include\":$(echo $matrix)}" >> $GITHUB_OUTPUT
          echo "matrixLength=$(echo $matrix | jq length)" >> $GITHUB_OUTPUT
          echo "packageMatrix={\"platform\":[\"amd64\",\"arm64\"],\"include\":$(echo $matrix)}" >> $GITHUB_OUTPUT

  build-packages:
    name: Build Packages
    runs-on: ubuntu-latest
    if: needs.build.outputs.matrixLength > 0

    needs:
      - build

    strategy:
      matrix: ${{fromJSON(needs.build.outputs.packageMatrix)}}
      fail-fast: false

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-skip-session-tagging: true
          role-duration-seconds: 3600
          aws-region: ap-southeast-1

      - name: Build image
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: somleng-switch-${{ matrix.platform }}
          buildspec-override:   |
            version: 0.2
            phases:
              install:
                commands:
                  # Temp fix: Remove this install phase. See: https://github.com/aws/aws-codebuild-docker-images/pull/642
                  - export BUILDX_VERSION=$(curl --silent "https://api.github.com/repos/docker/buildx/releases/latest" |jq -r .tag_name)
                  - curl -JLO "https://github.com/docker/buildx/releases/download/$BUILDX_VERSION/buildx-$BUILDX_VERSION.linux-${{ matrix.platform }}"
                  - mkdir -p ~/.docker/cli-plugins
                  - mv "buildx-$BUILDX_VERSION.linux-${{ matrix.platform }}" ~/.docker/cli-plugins/docker-buildx
                  - chmod +x ~/.docker/cli-plugins/docker-buildx

              build:
                steps:
                  - name: Build
                    run: |
                      aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
                      export DOCKER_BUILDKIT=1
                      cd components/media_proxy
                      docker build --cache-from ${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-${{ matrix.platform }} --tag ${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-${{ matrix.platform }} --push .
  build-manifest:
    name: Build Manifest
    runs-on: ubuntu-latest

    needs:
      - build
      - build-packages

    strategy:
      matrix: ${{fromJSON(needs.build.outputs.matrix)}}

    steps:
        - name: Configure AWS credentials
          uses: aws-actions/configure-aws-credentials@v2
          with:
            aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
            aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
            role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
            role-skip-session-tagging: true
            role-duration-seconds: 3600
            aws-region: ap-southeast-1

        - name: Set up Docker Buildx
          uses: docker/setup-buildx-action@v2

        - name: Build Manifest
          run: |
            aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
            declare -a platforms=("amd64" "arm64")
            source_images=$(printf "${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-%s " "${platforms[@]}")
            docker buildx imagetools create -t ${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }} -t ${{ env.ECR_REGISTRY }}/media-proxy:${{ env.IMAGE_TAG }} $source_images

  # Do this step in Github Actions because pushing to Github from AWS CodeBuild is slow
  publish_images:
    name: Publish Images
    runs-on: ubuntu-latest

    needs:
      - build
      - build-packages

    strategy:
      matrix: ${{fromJSON(needs.build.outputs.matrix)}}

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Images
        run: |
          declare -a platforms=("amd64" "arm64")

          for platform in "${platforms[@]}"
          do
            docker image pull ${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-$platform
            docker tag ${{ env.ECR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-$platform ${{ env.GHCR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-$platform
            docker push ${{ env.GHCR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-$platform
          done

          source_images=$(printf "${{ env.GHCR_REGISTRY }}/media-proxy:${{ matrix.image_tag }}-%s " "${platforms[@]}")
          docker buildx imagetools create -t ${{ env.GHCR_REGISTRY }}/media-proxy:${{ matrix.image_tag }} $source_images

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: components/media_proxy

    needs:
      - build
      - build-manifest

    if: needs.build.outputs.matrixLength > 0

    strategy:
      matrix: ${{fromJson(needs.build.outputs.matrix)}}

    steps:
      - name: Configure AWS credentials
        id: aws-login
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-skip-session-tagging: true
          role-duration-seconds: 3600
          aws-region: ap-southeast-1

      - name: Get current task definition
        run: |
          aws ecs describe-task-definition --task-definition "${{ matrix.identifier }}" --query 'taskDefinition' > task-definition.json

      - name: Inject new image into task definition
        id: render-task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: components/media_proxy/task-definition.json
          container-name: media_proxy
          image: ${{ env.ECR_REGISTRY }}/media-proxy:${{ env.IMAGE_TAG }}

      - name: Deploy
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.render-task-def.outputs.task-definition }}
          service: ${{ matrix.ecs_service }}
          cluster: ${{ matrix.ecs_cluster }}
          wait-for-service-stability: true