deployment.yaml

name: Deploy artifacts

on:
  workflow_call:
    inputs:
      deploy-channel:
        required: true
        type: string
    secrets:
      artifact-registry-uploader-json-creds:
        required: true

permissions:
  contents: read

jobs:
  set-variables:
    runs-on: ubuntu-24.04
    outputs:
      debian-version: ${{ steps.define-version.outputs.debian_version }}
      docker-version: ${{ steps.define-version.outputs.docker_version }}
    steps:
    - name: Define version
      id: define-version
      run: |
        TIME=$(date -u +'%Y%m%d%H%M')
        # TODO(b/440196950): Setup condition for stable channel.
        case "${{ inputs.deploy-channel }}" in
          unstable)
            # Debian package format : X.Y~gitYYYYMMDDHHMM-<Github SHA 8 digit>
            # Docker tag format     : X.Y-gitYYYYMMDDHHMM-<Github SHA 8 digit>
            SEMVER=$(echo ${{ github.ref_name }} | grep -oE '[0-9]+.[0-9]+')
            SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-8)
            DEBIAN_VERSION="${SEMVER}~git${TIME}-${SHORT_SHA}"
            DOCKER_VERSION="${SEMVER}-git${TIME}-${SHORT_SHA}"
            ;;
          nightly)
            # Debian package format : 0~gitYYYYMMDDHHMM-<Github SHA 8 digit>
            # Docker tag format     : gitYYYYMMDDHHMM-<Github SHA 8 digit>
            SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-8)
            DEBIAN_VERSION="0~git${TIME}-${SHORT_SHA}"
            DOCKER_VERSION="git${TIME}-${SHORT_SHA}"
            ;;
          *)
            exit 1
            ;;
        esac
        echo "debian_version=$DEBIAN_VERSION" >> $GITHUB_OUTPUT
        echo "docker_version=$DOCKER_VERSION" >> $GITHUB_OUTPUT
        echo "Debian package version is $DEBIAN_VERSION"
        echo "Docker tag version is $DOCKER_VERSION"

  deploy-cuttlefish-cvdremote-amd64-debian-package:
    needs: [set-variables]
    environment: deployment
    runs-on: ubuntu-24.04
    container:
      image: debian@sha256:9258a75a7e4323c9e5562b361effc84ee747920116d8adfc98a465a5cdc9150e # debian:bookworm-20250407 (amd64)
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Build debian package cuttlefish-cvdremote
      uses: ./.github/actions/build-cuttlefish-cvdremote-debian-package
      with:
        version: ${{ needs.set-variables.outputs.debian-version }}
    - name: Get exact filename
      run: echo "path=$(find . -name cuttlefish-cvdremote_*.deb)" >> $GITHUB_ENV
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Deploy debian package cuttlefish-cvdremote
      uses: ./.github/actions/deploy-cuttlefish-cvdremote-debian-package
      with:
        deploy-channel: ${{ inputs.deploy-channel }}
        path: ${{ env.path }}

  deploy-cuttlefish-cvdremote-arm64-debian-package:
    needs: [set-variables]
    environment: deployment
    runs-on: ubuntu-24.04-arm
    container:
      image: debian@sha256:00cd074b40c4d99ff0c24540bdde0533ca3791edcdac0de36d6b9fb3260d89e2 # debian:bookworm-20250407 (arm64/v8)
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Build debian package cuttlefish-cvdremote
      uses: ./.github/actions/build-cuttlefish-cvdremote-debian-package
      with:
        version: ${{ needs.set-variables.outputs.debian-version }}
    - name: Get exact filename
      run: echo "path=$(find . -name cuttlefish-cvdremote_*.deb)" >> $GITHUB_ENV
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Deploy debian package cuttlefish-cvdremote
      uses: ./.github/actions/deploy-cuttlefish-cvdremote-debian-package
      with:
        deploy-channel: ${{ inputs.deploy-channel }}
        path: ${{ env.path }}

  deploy-cuttlefish-cloud-orchestrator-amd64-docker-image:
    needs: [set-variables]
    environment: deployment
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Build docker image
      run: docker build -t cuttlefish-cloud-orchestrator .
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Login to Artifact Registry
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
      with:
        registry: us-docker.pkg.dev
        username: _json_key
        password: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Deploy docker image
      uses: ./.github/actions/deploy-cuttlefish-cloud-orchestrator-docker-image
      with:
        arch: amd64
        version: ${{ needs.set-variables.outputs.docker-version }}

  deploy-cuttlefish-cloud-orchestrator-arm64-docker-image:
    needs: [set-variables]
    environment: deployment
    runs-on: ubuntu-24.04-arm
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Build docker image
      run: docker build -t cuttlefish-cloud-orchestrator .
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Login to Artifact Registry
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
      with:
        registry: us-docker.pkg.dev
        username: _json_key
        password: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Deploy docker image
      uses: ./.github/actions/deploy-cuttlefish-cloud-orchestrator-docker-image
      with:
        arch: arm64
        version: ${{ needs.set-variables.outputs.docker-version }}

  deploy-cuttlefish-cloud-orchestrator-docker-manifest:
    needs: [deploy-cuttlefish-cloud-orchestrator-amd64-docker-image, deploy-cuttlefish-cloud-orchestrator-arm64-docker-image, set-variables]
    environment: deployment
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Login to Artifact Registry
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
      with:
        registry: us-docker.pkg.dev
        username: _json_key
        password: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: Deploy manifests
      run: |
        IMAGE=us-docker.pkg.dev/android-cuttlefish-artifacts/cuttlefish-orchestration/cuttlefish-cloud-orchestrator
        VERSION=${{ needs.set-variables.outputs.docker-version }}
        for MANIFEST_TAG in ${VERSION} ${{ inputs.deploy-channel }}; do
          docker manifest create ${IMAGE}:${MANIFEST_TAG} \
            --amend ${IMAGE}:${VERSION}-amd64 \
            --amend ${IMAGE}:${VERSION}-arm64
          docker manifest push ${IMAGE}:${MANIFEST_TAG}
        done

  deploy-cuttlefish-cloud-orchestrator-on-premise-config:
    needs: [set-variables]
    environment: deployment
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
    - name: Authentication on GCP project android-cuttlefish-artifacts
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.artifact-registry-uploader-json-creds }}'
    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v3.0.1'
      with:
        version: '>= 363.0.0'
    - name: Deploy conf.toml
      run: |
        # Retrieve conf.toml with substituting proper version of docker image.
        ORCHESTRATION_IMAGE="us-docker.pkg.dev/android-cuttlefish-artifacts/cuttlefish-orchestration/cuttlefish-orchestration"
        ORCHESTRATION_IMAGE_VERSION=$(gcloud artifacts docker tags list ${ORCHESTRATION_IMAGE} \
          --filter "tag ~ \".*${{ inputs.deploy-channel }}\$\"" \
          --format json \
          | jq '.[0].version'
        )
        ORCHESTRATION_TAG=$(gcloud artifacts docker tags list ${ORCHESTRATION_IMAGE} \
          --filter "(version=${ORCHESTRATION_IMAGE_VERSION}) AND NOT (tag ~ \".*${{ inputs.deploy-channel }}\$\" OR  tag ~ \".*latest\$\")" \
          --format json \
          | jq -r '.[0].tag | split("/") | last'
        )
        wget -O conf.toml "https://raw.githubusercontent.com/google/cloud-android-orchestration/${{ github.sha }}/scripts/on-premises/single-server/conf.toml"
        sed -i "s|DockerImageName = .*|DockerImageName = \"${ORCHESTRATION_IMAGE}:${ORCHESTRATION_TAG}\"|g" conf.toml

        # Update conf.toml on Artifact Registry
        gcloud artifacts versions delete ${{ inputs.deploy-channel }} \
          --location="us" \
          --package="on-premise-single-server" \
          --project="android-cuttlefish-artifacts" \
          --quiet \
          --repository="cloud-orchestrator-config"
        for VERSION in ${{ needs.set-variables.outputs.docker-version }} ${{ inputs.deploy-channel }}; do
          gcloud artifacts generic upload \
            --location="us" \
            --package="on-premise-single-server" \
            --project="android-cuttlefish-artifacts" \
            --repository="cloud-orchestrator-config" \
            --source="conf.toml" \
            --version="${VERSION}"
        done