Unifies multi-image Docker build & deployment

mbertelsen · mbertelsen · commit ee0d45a7450a · 2025-09-30T10:44:43.000+02:00
Removes outdated workflows in favor of separate build and deploy steps
Adopts OIDC-based Azure login for improved reliability and clarity
diff --git a/.github/workflows/deploy-azure.yml b/.github/workflows/deploy-azure.yml
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
@@ -1,84 +1,78 @@
-name: Build and Push Docker Image
+name: Build and Push Docker Images
 
 on:
   push:
     branches: [ main, develop ]
   pull_request:
     branches: [ main ]
-  # Allow manual trigger
   workflow_dispatch:
 
 env:
   REGISTRY: tpsappscriptingacr.azurecr.io
-  IMAGE_NAME: app-scripting-editor
+  IMAGE_STATIC: app-scripting-editor
+  IMAGE_API: app-scripting-editor-api
 
 jobs:
-  build-and-push:
+  build:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+      id-token: write
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-    - name: Assert required ACR secrets are set
-      run: |
-        if [ -z "${{ secrets.ACR_USERNAME }}" ]; then echo "ERROR: secrets.ACR_USERNAME is not set"; exit 1; fi
-        if [ -z "${{ secrets.ACR_PASSWORD }}" ]; then echo "ERROR: secrets.ACR_PASSWORD is not set"; exit 1; fi
+      # --- Login to ACR (simple user/pass; or swap to azure/login + OIDC if you prefer) ---
+      - name: Docker login to ACR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.ACR_USERNAME }}
+          password: ${{ secrets.ACR_PASSWORD }}
 
-    - name: Determine registry to use
-      id: registry
-      run: |
-        # Prefer explicit secret ACR_LOGIN_SERVER when present, otherwise use env.REGISTRY
-        if [ -n "${{ secrets.ACR_LOGIN_SERVER }}" ]; then
-          echo "registry=${{ secrets.ACR_LOGIN_SERVER }}" >> $GITHUB_OUTPUT
-        else
-          echo "registry=${{ env.REGISTRY }}" >> $GITHUB_OUTPUT
-        fi
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
 
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-    - name: Log in to Azure Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ steps.registry.outputs.registry }}
-        username: ${{ secrets.ACR_USERNAME }}
-        password: ${{ secrets.ACR_PASSWORD }}
+      # ---------- Build STATIC (nginx) image ----------
+      # IMPORTANT: set context/file to your actual static image Dockerfile.
+      # If your static image is built from the repo root with ./Dockerfile.nginx, set file accordingly.
+      - name: Build & push STATIC image (nginx)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile.nginx # <--- CHANGE if your static Dockerfile has a different path/name
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_STATIC }}:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE_STATIC }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_STATIC }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_STATIC }}:buildcache,mode=max
 
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ steps.registry.outputs.registry }}/${{ env.IMAGE_NAME }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=sha,prefix={{branch}}-
-          type=raw,value=latest,enable={{is_default_branch}}
-
-    - name: Ensure package-lock.json exists
-      run: |
-        if [ ! -f package-lock.json ]; then echo '{}' > package-lock.json; fi
-
-    - name: Build and push Docker image
-      id: build
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        file: ./Dockerfile
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        build-args: |
-          VITE_APP_VERSION=1.0.0
-          VITE_APP_BUILD_TIME=${{ github.event.head_commit.timestamp }}
-          VITE_APP_COMMIT_SHA=${{ github.sha }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
-        platforms: linux/amd64,linux/arm64
-
-    - name: Image digest
-      run: echo ${{ steps.build.outputs.digest }}
+      # ---------- Build API (Node/Express) image ----------
+      # This Dockerfile copies the built SPA from the STATIC image via:
+      #   ARG REGISTRY
+      #   FROM ${REGISTRY}/app-scripting-editor:latest AS web-build
+      #   COPY --from=web-build /usr/share/nginx/html ./editor-dist
+      #
+      # Therefore we MUST pass REGISTRY as a build-arg.
+      - name: Build & push API image (Node/Express + SPA)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile # <--- CHANGE if your API Dockerfile has a different path/name
+          push: true
+          build-args: |
+            REGISTRY=${{ env.REGISTRY }}
+            VITE_APP_VERSION=1.0.0
+            VITE_APP_BUILD_TIME=${{ github.event.head_commit.timestamp }}
+            VITE_APP_COMMIT_SHA=${{ github.sha }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_API }}:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE_API }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_API }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_API }}:buildcache,mode=max
diff --git a/.github/workflows/docker-deploy.yml b/.github/workflows/docker-deploy.yml
@@ -1,130 +1,73 @@
-name: Build and deploy containers to Azure
+name: Deploy API Image to Azure App Service
 
 on:
-  push:
+  workflow_run:
+    workflows: ["Build and Push Docker Images"]
+    types: [ completed ]
     branches: [ main ]
+  workflow_dispatch:
+
+env:
+  AZURE_WEBAPP_NAME: tps-app-scripting-editor
+  AZURE_RESOURCE_GROUP: tps-app-scripting-rg
+  REGISTRY: tpsappscriptingacr.azurecr.io
+  IMAGE_API: app-scripting-editor-api
+  # optional: use your Front Door host for health check; leave blank to use default *.azurewebsites.net
+  FRONTDOOR_HOST: app-scripting-editor.trackmangolfdev.com
 
 jobs:
-  build-and-push:
+  deploy:
     runs-on: ubuntu-latest
-    env:
-      REGISTRY: tpsappscriptingacr.azurecr.io
-    outputs:
-      registry: ${{ steps.registry.outputs.registry }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Assert required ACR secrets are set
-        run: |
-          if [ -z "${{ secrets.ACR_USERNAME }}" ]; then echo "ERROR: secrets.ACR_USERNAME is not set"; exit 1; fi
-          if [ -z "${{ secrets.ACR_PASSWORD }}" ]; then echo "ERROR: secrets.ACR_PASSWORD is not set"; exit 1; fi
+    permissions:
+      id-token: write
+      contents: read
 
-      - name: Determine registry to use
-        id: registry
-        run: |
-          if [ -n "${{ secrets.ACR_LOGIN_SERVER }}" ]; then echo "registry=${{ secrets.ACR_LOGIN_SERVER }}" >> $GITHUB_OUTPUT; else echo "registry=${{ env.REGISTRY }}" >> $GITHUB_OUTPUT; fi
-
-      - name: Log in to Azure Container Registry
-        uses: azure/docker-login@v1
-        with:
-          login-server: ${{ steps.registry.outputs.registry }}
-          username: ${{ secrets.ACR_USERNAME }}
-          password: ${{ secrets.ACR_PASSWORD }}
-
-      - name: Build and push editor image
-        run: |
-          docker build \
-            --build-arg VITE_APP_BUILD_TIME=${{ github.event.head_commit.timestamp }} \
-            --build-arg VITE_APP_COMMIT_SHA=${{ github.sha }} \
-            --build-arg VITE_APP_VERSION=1.0.0 \
-            -t ${{ steps.registry.outputs.registry }}/app-scripting-editor:latest .
-          docker push ${{ steps.registry.outputs.registry }}/app-scripting-editor:latest
-
-      - name: Build and push editor-api image
-        run: |
-          docker build \
-            --build-arg REGISTRY=${{ steps.registry.outputs.registry }} \
-            --build-arg VITE_APP_BUILD_TIME=${{ github.event.head_commit.timestamp }} \
-            --build-arg VITE_APP_COMMIT_SHA=${{ github.sha }} \
-            --build-arg VITE_APP_VERSION=1.0.0 \
-            -t ${{ steps.registry.outputs.registry }}/app-scripting-editor-api:latest -f server/Dockerfile .
-          docker push ${{ steps.registry.outputs.registry }}/app-scripting-editor-api:latest
-
-  deploy-to-appservice:
-    needs: build-and-push
-    runs-on: ubuntu-latest
     steps:
-      - name: Check required App Service secrets
-        id: check-secrets
-        run: |
-          if [ -z "${{ secrets.EDITOR_APP_NAME }}" ] || [ -z "${{ secrets.RESOURCE_GROUP }}" ] || [ -z "${{ secrets.EDITOR_API_APP_NAME }}" ]; then
-            echo "deploy_ready=false" >> $GITHUB_OUTPUT
-            echo "One or more App Service secrets are missing; skipping deploy steps."
-          else
-            echo "deploy_ready=true" >> $GITHUB_OUTPUT
-          fi
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Azure Login
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
-        uses: azure/login@v1
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-      - name: Deploy editor to App Service (container)
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
+      - name: Set API image on App Service
         run: |
-          # Deploy the API image to the public editor App Service so the same hostname serves the SPA and the /api endpoints.
-          az webapp config container set --name ${{ secrets.EDITOR_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --docker-custom-image-name ${{ needs.build-and-push.outputs.registry }}/app-scripting-editor-api:latest
+          az webapp config container set             --name "${{ env.AZURE_WEBAPP_NAME }}"             --resource-group "${{ env.AZURE_RESOURCE_GROUP }}"             --docker-custom-image-name "${{ env.REGISTRY }}/${{ env.IMAGE_API }}:latest"             --docker-registry-server-url "https://${{ env.REGISTRY }}"             --docker-registry-server-user "${{ secrets.ACR_USERNAME }}"             --docker-registry-server-password "${{ secrets.ACR_PASSWORD }}"
 
-      - name: Set WEBSITES_PORT for editor (public) app
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
+      - name: Ensure WEBSITES_PORT=4000 (Express listens here)
         run: |
-          echo "Setting WEBSITES_PORT=4000 for ${{ secrets.EDITOR_APP_NAME }}"
-          az webapp config appsettings set --name ${{ secrets.EDITOR_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --settings WEBSITES_PORT=4000
+          az webapp config appsettings set             --name "${{ env.AZURE_WEBAPP_NAME }}"             --resource-group "${{ env.AZURE_RESOURCE_GROUP }}"             --settings WEBSITES_PORT=4000
 
-      - name: Deploy editor-api to App Service (container)
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
+      - name: Restart App
         run: |
-          az webapp config container set --name ${{ secrets.EDITOR_API_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --docker-custom-image-name ${{ needs.build-and-push.outputs.registry }}/app-scripting-editor-api:latest
+          az webapp restart             --name "${{ env.AZURE_WEBAPP_NAME }}"             --resource-group "${{ env.AZURE_RESOURCE_GROUP }}"
 
-      - name: Set WEBSITES_PORT for editor-api
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
+      - name: Determine public host for health check
+        id: host
         run: |
-          echo "Setting WEBSITES_PORT=4000 for ${EDITOR_API_APP_NAME}"
-          az webapp config appsettings set --name ${{ secrets.EDITOR_API_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --settings WEBSITES_PORT=4000
-
-      - name: Smoke test editor-api
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
-        run: |
-          host=$(az webapp show --name ${{ secrets.EDITOR_API_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --query defaultHostName -o tsv)
-          echo "Testing https://$host/api/health"
-          for i in 1 2 3 4 5 6 7 8 9 10; do
-            status=$(curl -s -o /dev/null -w "%{http_code}" "https://$host/api/health" || echo "000")
-            if [ "$status" = "200" ]; then
-              echo "OK: health returned 200"
-              exit 0
-            fi
-            echo "Attempt $i: status=$status; retrying in 5s..."
-            sleep 5
-          done
-          echo "ERROR: editor-api did not become healthy"
-          az webapp log tail --name ${{ secrets.EDITOR_API_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} &
-          exit 1
+          if [ -n "${{ env.FRONTDOOR_HOST }}" ]; then
+            echo "host=${{ env.FRONTDOOR_HOST }}" >> "$GITHUB_OUTPUT"
+          else
+            host=$(az webapp show --name "${{ env.AZURE_WEBAPP_NAME }}" --resource-group "${{ env.AZURE_RESOURCE_GROUP }}" --query defaultHostName -o tsv)
+            echo "host=${host}" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Smoke test public editor app
-        if: ${{ steps.check-secrets.outputs.deploy_ready == 'true' }}
+      - name: Wait for /api/health = 200
         run: |
-          host=$(az webapp show --name ${{ secrets.EDITOR_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --query defaultHostName -o tsv)
-          echo "Testing https://$host/api/health"
-          for i in 1 2 3 4 5 6 7 8 9 10; do
-            status=$(curl -s -o /dev/null -w "%{http_code}" "https://$host/api/health" || echo "000")
-            if [ "$status" = "200" ]; then
-              echo "OK: public editor health returned 200"
+          set -e
+          url="https://${{ steps.host.outputs.host }}/api/health"
+          echo "Checking $url ..."
+          for i in {1..20}; do
+            code=$(curl -s -o /dev/null -w "%{http_code}" "$url" || echo "000")
+            echo "Attempt $i -> $code"
+            if [ "$code" = "200" ]; then
+              echo "Healthy."
               exit 0
             fi
-            echo "Attempt $i: status=$status; retrying in 5s..."
             sleep 5
           done
-          echo "ERROR: public editor did not become healthy"
-          az webapp log tail --name ${{ secrets.EDITOR_APP_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} &
+          echo "ERROR: health never reached 200"
           exit 1
