ecr-release.yml

name: ecr-release.yml
on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write # This is required for requesting the JWT

env:
  path_to_dockerfile: "DockerFile"
  docker_build_dir: "."
  aws_region: "us-east-1"
  ecr_repository_name: "o4w4w0v6/aws-durable-execution-emulator"

jobs:
  build-and-upload-image-to-ecr:
    runs-on: ubuntu-latest
    outputs:
      full_image_arm64: ${{ steps.build-publish.outputs.full_image_arm64 }}
      full_image_x86_64: ${{ steps.build-publish.outputs.full_image_x86_64 }}
      ecr_registry_repository: ${{ steps.build-publish.outputs.ecr_registry_repository }}
      version: ${{ steps.version.outputs.VERSION }}
    strategy:
      matrix:
        include:
          - arch: x86_64
          - arch: arm64
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install hatch
      - name: Set up QEMU for multi-platform builds
        if: matrix.arch == 'arm64'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - name: Install specific version of Virtual Env due to bug with hatch
        run: |
          python -m pip install virtualenv==20.39.0
      - name: Build distribution
        run: hatch build
      - name: pip install
        run: |
          pip install -e .
      - name: Get version from __about__.py
        id: version
        run: |
          VERSION=$(python -c "from aws_durable_execution_sdk_python_testing import __version__; print(__version__)")
          echo "VERSION=$VERSION"
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ECR_UPLOAD_IAM_ROLE_ARN }}
          aws-region: ${{ env.aws_region }}
      - name: Login to Amazon ECR
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public
      - name: Build, tag, and push image to Amazon ECR
        id: build-publish
        shell: bash
        env:
          ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
          ECR_REPOSITORY: ${{ env.ecr_repository_name }}
          IMAGE_TAG: "${{ env.image_tag }}v${{ steps.version.outputs.VERSION }}"
          PER_ARCH_IMAGE_TAG: "${{ matrix.arch }}v${{ steps.version.outputs.VERSION }}"
        run: |
          if [ "${{ matrix.arch }}" = "x86_64" ]; then
            docker build --platform linux/amd64 --provenance false "${{ env.docker_build_dir }}" -f "${{ env.path_to_dockerfile }}" -t "$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
          else
            docker build --platform linux/arm64 --provenance false "${{ env.docker_build_dir }}" -f "${{ env.path_to_dockerfile }}" -t "$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
          fi
          docker push "$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
          echo "IMAGE $PER_ARCH_IMAGE_TAG is pushed to $ECR_REGISTRY/$ECR_REPOSITORY"
          echo "image_tag=$PER_ARCH_IMAGE_TAG"
          echo "full_image=$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG"
          echo "ecr_registry_repository=$ECR_REGISTRY/$ECR_REPOSITORY" >> $GITHUB_OUTPUT
          echo "full_image_${{ matrix.arch }}=$ECR_REGISTRY/$ECR_REPOSITORY:$PER_ARCH_IMAGE_TAG" >> $GITHUB_OUTPUT
  create-ecr-manifest-per-arch:
    runs-on: ubuntu-latest
    needs: [build-and-upload-image-to-ecr]
    steps:
      - name: Grab image, registry/repository name, version from previous steps
        id: ecr_names
        env:
          ECR_REGISTRY_REPOSITORY: ${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}
          FULL_IMAGE_ARM64: ${{ needs.build-and-upload-image-to-ecr.outputs.full_image_arm64 }}
          FULL_IMAGE_X86_64: ${{ needs.build-and-upload-image-to-ecr.outputs.full_image_x86_64 }}
          VERSION: ${{ needs.build-and-upload-image-to-ecr.outputs.version }}
        run: |
          echo "full_image_arm64=$FULL_IMAGE_ARM64"
          echo "ecr_registry_repository=$ECR_REGISTRY_REPOSITORY"
          echo "full_image_x86_64=$FULL_IMAGE_X86_64"
          echo "version=$VERSION"
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ECR_UPLOAD_IAM_ROLE_ARN }}
          aws-region: ${{ env.aws_region }}
      - name: Login to Amazon ECR
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public
      - name: Create ECR manifest with explicit tag
        id: create-ecr-manifest-explicit
        run: |
          docker manifest create "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}:v${{ needs.build-and-upload-image-to-ecr.outputs.version }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_x86_64 }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_arm64 }}"
      - name: Annotate ECR manifest with explicit arm64 tag
        id: annotate-ecr-manifest-explicit-arm64
        run: |
          docker manifest annotate "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}:v${{ needs.build-and-upload-image-to-ecr.outputs.version }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_arm64 }}" \
            --arch arm64 \
            --os linux
      - name: Annotate ECR manifest with explicit amd64 tag
        id: annotate-ecr-manifest-explicit-amd64
        run: |
          docker manifest annotate "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}:v${{ needs.build-and-upload-image-to-ecr.outputs.version }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_x86_64 }}" \
            --arch amd64 \
            --os linux
      - name: Push ECR manifest with explicit version
        id: push-ecr-manifest-explicit
        run: |
          docker manifest push "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}:v${{ needs.build-and-upload-image-to-ecr.outputs.version }}"
      - name: Create ECR manifest with latest tag
        id: create-ecr-manifest-latest
        run: |
          docker manifest create "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_arm64 }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_x86_64 }}"
      - name: Annotate ECR manifest with latest tag arm64
        id: annotate-ecr-manifest-latest-arm64
        run: |
          docker manifest annotate "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_arm64 }}" \
            --arch arm64 \
            --os linux
      - name: Annotate ECR manifest with latest tag amd64
        id: annotate-ecr-manifest-latest-amd64
        run: |
          docker manifest annotate "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}" \
            "${{ needs.build-and-upload-image-to-ecr.outputs.full_image_x86_64 }}" \
            --arch amd64 \
            --os linux
      - name: Push ECR manifest with latest
        id: push-ecr-manifest-latest
        run: |
          docker manifest push "${{ needs.build-and-upload-image-to-ecr.outputs.ecr_registry_repository }}"