Feature: Added use of GHCR

.github/workflows/deploy_backend_dev.yml

@@ -9,14 +9,38 @@ concurrency:
   group: deploy-backend-dev
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
-  deploy:
+  build-and-push:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: ghcr.io/scimma/heroic:dev
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
       - name: Prepare SSH
         shell: bash
         run: |
@@ -59,36 +83,41 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          GHCR_TOKEN="${{ secrets.GITHUB_TOKEN }}"
+          GHCR_ACTOR="${{ github.actor }}"
           ssh -i ~/.ssh/id_deploy \
               -o IdentitiesOnly=yes \
               -o BatchMode=yes \
               "${{ secrets.DEV_SSH_USER }}@${{ secrets.DEV_SSH_HOST }}" \
-              'bash -se' <<'REMOTE'
+              "GHCR_TOKEN=${GHCR_TOKEN} GHCR_ACTOR=${GHCR_ACTOR} bash -se" <<'REMOTE'
           set -euo pipefail
 
           DEPLOY_PATH="$HOME/heroic"
           FRONTEND_PATH="$HOME/heroic-frontend"
+          HEROIC_IMAGE="ghcr.io/scimma/heroic:dev"
 
           cd "$DEPLOY_PATH"
           git fetch origin --prune
           git checkout development
           git reset --hard origin/development
 
+          echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_ACTOR" --password-stdin
+
           if [ -d "$FRONTEND_PATH" ]; then
             (cd "$FRONTEND_PATH" && docker compose down) || true
           fi
 
           docker compose -f docker-compose.yml -f docker-compose.dev.yml down --remove-orphans
-          docker compose -f docker-compose.yml -f docker-compose.dev.yml build
-          docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.dev.yml pull
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
 
           if [ -d "$FRONTEND_PATH" ]; then
             (cd "$FRONTEND_PATH" && docker compose up --no-build -d) || true
           fi
 
           sleep 20
 
-          docker compose -f docker-compose.yml -f docker-compose.dev.yml exec -T backend poetry run python manage.py collectstatic --noinput
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.dev.yml exec -T backend poetry run python manage.py collectstatic --noinput
 
           REMOTE
 

.github/workflows/deploy_backend_prod.yml

@@ -9,14 +9,44 @@ concurrency:
   group: deploy-backend-prod
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
-  deploy:
+  build-and-push:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version tag
+        id: tag
+        run: echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: |
+            ghcr.io/scimma/heroic:${{ steps.tag.outputs.version }}
+            ghcr.io/scimma/heroic:latest
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
       - name: Prepare SSH
         shell: bash
         run: |
@@ -59,37 +89,43 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          GHCR_TOKEN="${{ secrets.GITHUB_TOKEN }}"
+          GHCR_ACTOR="${{ github.actor }}"
+          VERSION="${{ github.ref_name }}"
           ssh -i ~/.ssh/id_deploy \
               -o IdentitiesOnly=yes \
               -o BatchMode=yes \
               "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
-              'bash -se' <<'REMOTE'
+              "GHCR_TOKEN=${GHCR_TOKEN} GHCR_ACTOR=${GHCR_ACTOR} VERSION=${VERSION} bash -se" <<'REMOTE'
           set -euo pipefail
 
           DEPLOY_PATH="$HOME/heroic"
           FRONTEND_PATH="$HOME/heroic-frontend"
+          HEROIC_IMAGE="ghcr.io/scimma/heroic:${VERSION}"
 
           cd "$DEPLOY_PATH"
           git fetch origin --prune
           git fetch --tags origin --force
           git checkout main
           git reset --hard origin/main
 
+          echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_ACTOR" --password-stdin
+
           if [ -d "$FRONTEND_PATH" ]; then
             (cd "$FRONTEND_PATH" && docker compose down) || true
           fi
 
           docker compose -f docker-compose.yml -f docker-compose.prod.yml down --remove-orphans
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml build
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.prod.yml pull
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
 
           if [ -d "$FRONTEND_PATH" ]; then
             (cd "$FRONTEND_PATH" && docker compose up --no-build -d) || true
           fi
 
           sleep 20
 
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml exec -T backend poetry run python manage.py collectstatic --noinput
+          HEROIC_IMAGE="$HEROIC_IMAGE" docker compose -f docker-compose.yml -f docker-compose.prod.yml exec -T backend poetry run python manage.py collectstatic --noinput
 
           REMOTE
 

docker-compose.yml

@@ -30,10 +30,7 @@ services:
       - redis_data:/data
 
   backend:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: heroic
+    image: ${HEROIC_IMAGE:-heroic}
     restart: always
     env_file:
       - .env
@@ -54,10 +51,7 @@ services:
       - heroic_net
 
   ingestor:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: heroic
+    image: ${HEROIC_IMAGE:-heroic}
     command: ["python", "manage.py", "readstreams"]
     restart: always
     env_file:
@@ -76,10 +70,7 @@ services:
       - heroic_net
 
   dramatiq_task_scheduler:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: heroic
+    image: ${HEROIC_IMAGE:-heroic}
     env_file:
       - .env
     environment:
@@ -100,10 +91,7 @@ services:
       - heroic_net
 
   dramatiq_worker:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: heroic
+    image: ${HEROIC_IMAGE:-heroic}
     env_file:
       - .env
     environment: