From 76bb67b9ff5d7d5dc4b57ee813f9d35890a00358 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Mon, 7 Nov 2022 14:16:28 +0100
Subject: [PATCH] ci: rework deploy

---
 .github/workflows/docker-image.yml | 123 +++++++++++++++++------------
 1 file changed, 73 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 959d510a9b..c7146cdd7b 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -25,50 +25,43 @@ jobs:
           fetch-depth: 0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Docker meta local
-        id: meta-local
+
+      - name: Docker meta
+        id: meta-slim
+        if: github.event_name == 'pull_request'
         uses: docker/metadata-action@v4
         with:
-          images: ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: |
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim
           tags: |
             type=ref,event=branch
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
 
-      - name: Build and push privately
+      - name: Build and push publicly
         uses: docker/build-push-action@v3
         if: github.event_name == 'pull_request'
         with:
           context: .
           push: true
           tags: |
-            ${{ steps.meta-local.outputs.tags }}
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest
+            ${{ steps.meta-slim.outputs.tags }}
+          labels: |
+            ${{ steps.meta-slim.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
 
-          labels: ${{ steps.meta-local.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
 
       - name: Docker meta
+        id: meta-slim-public
         if: github.event_name != 'pull_request'
-        id: meta-slim
         uses: docker/metadata-action@v4
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-
-      - name: Docker meta
-        if: github.event_name != 'pull_request'
-        id: meta-heavy
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim
           tags: |
             type=ref,event=branch
             type=ref,event=pr
@@ -76,47 +69,31 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
 
       - name: Login to registry
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
+        if: github.event_name != 'pull_request'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Login to ECR
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.ECR_REGISTRY }}
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
       - name: Build and push publicly
-        uses: docker/build-push-action@v3
         if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          labels: ${{ steps.meta-local.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest
+            ${{ steps.meta-slim-public.outputs.tags }}
+          labels: |
+            ${{ steps.meta-slim-public.outputs.labels }}
+            org.opencontainers.image.licenses=AGPLv3
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:buildcache
+
+
 
-      - name: Build and push publicly
-        uses: docker/build-push-action@v3
-        if: github.event_name != 'pull_request'
-        with:
-          context: .
-          push: true
-          file: ./DockerfileHeavy
-          tags: |
-            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ steps.meta-local.outputs.tags }}
-            ${{ steps.meta-heavy.outputs.tags }}
-          labels: ${{ steps.meta-local.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
-          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
   playwright:
     runs-on: [self-hosted, new]
     needs: [build]
@@ -137,7 +114,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: "Docker"
-        run: echo "::set-output name=id::$(docker run --network=host --rm -d -p 8000:8000 --privileged -it -e DATABASE_URL=postgres://admin:changeme@localhost:5432/windmill -e BASE_INTERNAL_URL=http://localhost:8000 ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:latest)"
+        run: echo "::set-output name=id::$(docker run --network=host --rm -d -p 8000:8000 --privileged -it -e DATABASE_URL=postgres://admin:changeme@localhost:5432/windmill -e BASE_INTERNAL_URL=http://localhost:8000 ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}-slim:latest)"
         id: docker-container
       - name: "Playwright run"
         timeout-minutes: 2
@@ -145,3 +122,49 @@ jobs:
       - name: "Clean up"
         run: docker kill ${{ steps.docker-container.outputs.id }}
         if: always()
+
+  publish_privately:
+    runs-on: [self-hosted, new]
+    needs: [build]
+    if: github.event_name != 'pull_request'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker meta
+        id: meta-heavy
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+
+      - name: Login to ECR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.ECR_REGISTRY }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          
+      - name: Build and push privately
+        uses: docker/build-push-action@v3
+        if: github.event_name != 'pull_request'
+        with:
+          context: .
+          push: true
+          file: ./DockerfileHeavy
+          tags: |
+            ${{ steps.meta-heavy.outputs.tags }}
+          labels: ${{ steps.meta-heavy.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.LOCAL_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max