monitoring-build-push-ecr.yml

name: "Build and push on-chain monitor image to ECR"

on:
  push:
    branches:
      - develop
    paths:
      - monitoring/**
      - relayer/**

jobs:
  build-and-publish-monitoring:
    runs-on: ubuntu-latest
    environment: publish
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
          role-duration-seconds: ${{ secrets.AWS_ROLE_DURATION_SECONDS }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Login to ECR
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ${{ secrets.MONITORING_ECR_HOSTNAME }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: Generate docker metadata
        id: docker_meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          flavor: | # prevent auto tagging with latest
            latest=false
          images: ${{ secrets.MONITORING_ECR_HOSTNAME }}
          tags: type=sha,format=long

      - name: Build and push docker image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
        with:
          push: true
          context: ./
          file: monitoring/ops/Dockerfile
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}