fix(identity): harden admin checks and campsite_user_id backfill (#2166) #265
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Web UI deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/web-deploy.yml" | |
| - "moon/apps/web/**" | |
| - "moon/packages/**" | |
| env: | |
| TIPTAP_PRIVATE_REGISTRY_KEY: ${{ secrets.TIPTAP_PRIVATE_REGISTRY_KEY }} | |
| REGISTRY_ALIAS: m8q5m4u3 | |
| REPOSITORY: mega/mega-ui | |
| IMAGE_VERSION: latest | |
| HARBOR_REGISTRY: registry.xuanwu.openatom.cn | |
| # TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore. | |
| PUSH_AWS_ECR: "false" | |
| # actions: write is required for docker buildx --cache-{from,to} type=gha. | |
| permissions: | |
| id-token: write | |
| contents: read | |
| actions: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Build ONE environment-agnostic image. | |
| # | |
| # NEXT_PUBLIC_* values are NOT baked per environment anymore: the image is | |
| # built with placeholder URLs (moon/apps/web/.env.runtime) that are replaced | |
| # at container start by docker-entrypoint.sh using runtime env vars. Each | |
| # environment (ECS task definition) must supply its own NEXT_PUBLIC_* values | |
| # at runtime. | |
| # --------------------------------------------------------------------------- | |
| build-push: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| id-token: write | |
| contents: read | |
| actions: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw | |
| # `docker buildx --cache-{from,to} type=gha` in the build step. | |
| - name: Expose GitHub Actions runtime env | |
| uses: crazy-max/ghaction-github-runtime@v3 | |
| - name: Configure AWS Credentials (ECR Public, us-east-1) | |
| if: env.PUSH_AWS_ECR == 'true' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| if: env.PUSH_AWS_ECR == 'true' | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| - name: Build & push unified image | |
| working-directory: moon | |
| env: | |
| ECR_PUBLIC_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| PLATFORM: linux/amd64 | |
| PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }} | |
| run: | | |
| set -euo pipefail | |
| ARCH_SUFFIX="amd64" | |
| IMAGE_TAG="${IMAGE_VERSION}-${ARCH_SUFFIX}" | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| SHA_TAG="${SHORT_SHA}-${ARCH_SUFFIX}" | |
| HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| HARBOR_IMAGE_SHA="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$SHA_TAG" | |
| TAGS=(-t "$HARBOR_IMAGE" -t "$HARBOR_IMAGE_SHA") | |
| if [ "$PUSH_AWS_ECR" = "true" ]; then | |
| PUBLIC_IMAGE="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG" | |
| PUBLIC_IMAGE_SHA="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$SHA_TAG" | |
| TAGS+=(-t "$PUBLIC_IMAGE" -t "$PUBLIC_IMAGE_SHA") | |
| else | |
| echo "TEMP: skipping AWS ECR push (Harbor only)" | |
| fi | |
| docker buildx build \ | |
| --platform "$PLATFORM" \ | |
| --build-arg TIPTAP_PRIVATE_REGISTRY_KEY="$TIPTAP_PRIVATE_REGISTRY_KEY" \ | |
| --cache-from type=gha,scope=mega-ui \ | |
| --cache-to type=gha,mode=max,scope=mega-ui \ | |
| --provenance=false \ | |
| --sbom=false \ | |
| -f apps/web/Dockerfile \ | |
| "${TAGS[@]}" . \ | |
| --push | |
| manifest: | |
| needs: build-push | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Configure AWS Credentials | |
| if: env.PUSH_AWS_ECR == 'true' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Login to Amazon ECR Public | |
| if: env.PUSH_AWS_ECR == 'true' | |
| id: login-ecr-public | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| registry-type: public | |
| - name: Login to Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.HARBOR_REGISTRY }} | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_PASSWORD }} | |
| - name: Create & push unified manifest | |
| env: | |
| REGISTRY: ${{ steps.login-ecr-public.outputs.registry }} | |
| PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }} | |
| run: | | |
| set -euo pipefail | |
| HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}" | |
| TAG="${IMAGE_VERSION}" | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| push_manifests() { | |
| local base="$1" | |
| docker manifest create "$base:$TAG" \ | |
| "$base:${TAG}-amd64" | |
| docker manifest push "$base:$TAG" | |
| docker manifest create "$base:$SHORT_SHA" \ | |
| "$base:${SHORT_SHA}-amd64" | |
| docker manifest push "$base:$SHORT_SHA" | |
| } | |
| if [ "$PUSH_AWS_ECR" = "true" ]; then | |
| IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}" | |
| push_manifests "$IMAGE_BASE" | |
| else | |
| echo "TEMP: skipping AWS ECR manifests (Harbor only)" | |
| fi | |
| push_manifests "$HARBOR_BASE" | |
| deploy-aws: | |
| needs: manifest | |
| if: false # disabled | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| include: | |
| - cluster: gitmega-com | |
| service: mega-frontend-development-service-6dcihwup | |
| - cluster: gitmono-com-mega-app | |
| service: mega-ui-service | |
| steps: | |
| - name: Force ECS redeploy | |
| run: | | |
| aws ecs update-service \ | |
| --cluster ${{ matrix.cluster }} \ | |
| --service ${{ matrix.service }} \ | |
| --force-new-deployment | |
| env: | |
| AWS_REGION: ap-southeast-2 | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |