build_push_prod_container.yml

name: Build and push Production container

on:
  release:
    types:
      - created

env:
  AWS_REGION: ca-central-1
  DOCKER_BUILDKIT: 1
  REPO_NAME: platform/wordpress
  PRODUCTION_ECR_REGISTRY: 472286471787.dkr.ecr.ca-central-1.amazonaws.com

permissions:
  id-token: write
  contents: read

jobs:
  build-push-prod-container:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::472286471787:role/gc-articles-ecr-tag-release
          role-session-name: ECRPush
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1

      - name: Docker image tag
        run: |
          if [[ $GITHUB_EVENT_NAME == "release" ]]; then
            echo "IMAGE_TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
          else
            echo "IMAGE_TAG=sha-${GITHUB_SHA}" >> $GITHUB_ENV
          fi

      - name: Add Composer auth credentials
        run: |
          cd wordpress
          composer config github-oauth.github.com ${{ secrets.COMPOSER_GITHUB_TOKEN }}
          composer config http-basic.my.yoast.com token ${{ secrets.COMPOSER_YOAST_TOKEN }}

      - name: Build container
        run: |
          docker build \
          --build-arg git_sha="$GITHUB_SHA" \
          --build-arg WPML_USER_ID="${{ secrets.WPML_USER_ID }}" \
          --build-arg WPML_KEY="${{ secrets.WPML_KEY }}" \
          -t "${{ env.PRODUCTION_ECR_REGISTRY }}/${{ env.REPO_NAME }}:${{ env.IMAGE_TAG }}" \
          -f ./wordpress/docker/Dockerfile .

      - name: Push containers to ECR
        run: |
          docker push ${{ env.PRODUCTION_ECR_REGISTRY }}/${{ env.REPO_NAME }}:${{ env.IMAGE_TAG }}

      - name: Logout of ECR
        if: always()
        run: docker logout ${{ steps.login-ecr.outputs.registry }}