Skip to content
Closed
Show file tree
Hide file tree
Changes from 29 commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
cbc5870
chore: move secrets out of chart, add env-uzh-stg values
rschlaefli Sep 13, 2025
be21f3a
Merge branch 'v3' into clean-argocd
jabbadizzleCode Sep 16, 2025
d6f8a27
chore: build arm images
jabbadizzleCode Sep 17, 2025
8d0501d
chore(deploy): remove secrets and modifed values.yaml for KlickerUZH …
jabbadizzleCode Sep 18, 2025
c6e55e4
chore(deploy): added image tags
jabbadizzleCode Sep 18, 2025
7ed9a34
chore(deploy): updated domains
jabbadizzleCode Sep 18, 2025
0a04f51
chore(deploy): remove redis
jabbadizzleCode Sep 18, 2025
e22fcfd
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Sep 18, 2025
2256005
chore: infisical init
jabbadizzleCode Sep 18, 2025
19559cb
chore(deploy): update domain name, change api domain
jabbadizzleCode Sep 18, 2025
5963141
chore(apps/chat): add env file
jabbadizzleCode Sep 18, 2025
6a722bc
chore(apps/chat): ingress for chat
jabbadizzleCode Sep 18, 2025
c42d534
chore(deploy): fixed cors issue
jabbadizzleCode Sep 19, 2025
b76c54e
chore(deploy): workflow, env for prd
jabbadizzleCode Sep 19, 2025
fb9b578
chore(deploy): update values
jabbadizzleCode Sep 19, 2025
9e92f6d
chore(deploy): infisical scripts
jabbadizzleCode Sep 19, 2025
349d184
Merge from v3
jabbadizzleCode Sep 22, 2025
133f2ba
wip(deploy): remove secret
jabbadizzleCode Sep 22, 2025
4b5bb03
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Sep 23, 2025
0071f29
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Sep 23, 2025
48e18a2
wip(backup): backup and restore scripts for new infra
jabbadizzleCode Sep 24, 2025
2a45115
wip(backup): modified description of dump script
jabbadizzleCode Sep 24, 2025
fe7e9aa
wip(util): script for syncing stg secrets from prd-infisical to stg-i…
jabbadizzleCode Sep 24, 2025
e53c785
wip(util): dump and restore for blob storage container
jabbadizzleCode Sep 25, 2025
dcf855a
wip(util): backup and restore for blob storage tables
jabbadizzleCode Sep 25, 2025
543da53
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Sep 25, 2025
6ceeafd
wip(backup): dump all containers from azure storage account
jabbadizzleCode Sep 26, 2025
57b76b2
wip: removed qa deployment workflows, multi-arch image builds
jabbadizzleCode Sep 27, 2025
a76edcb
wip(util): sync script for Hatchet project
jabbadizzleCode Sep 27, 2025
0c2fdbc
wip: wait for services in run app dependencies
jabbadizzleCode Sep 29, 2025
a6c945b
wip(deploy): add tolerations and taints for new infra
jabbadizzleCode Oct 27, 2025
d5310d3
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Oct 27, 2025
8ec019e
wip(deploy): add taints and tolerations for response-api-assessment
jabbadizzleCode Oct 27, 2025
6d3e7b2
wip(deploy): remove taints and tolerations for non-assessment deploym…
jabbadizzleCode Oct 28, 2025
b51ae2b
Merge branch 'v3' of github.com:uzh-bf/klicker-uzh into clean-argocd
jabbadizzleCode Nov 12, 2025
5bc6c0c
chore: use infisical instead of doppler
jabbadizzleCode Nov 12, 2025
ac5a7a6
wip(deploy): update values.yaml
jabbadizzleCode Nov 13, 2025
4234288
chore: update comments from doppler to infisical, change api origin f…
jabbadizzleCode Nov 13, 2025
b0fcae7
chore: update env
jabbadizzleCode Nov 13, 2025
279c8f9
chore: update runner
jabbadizzleCode Nov 13, 2025
e027015
chore: undo dfDomain change
jabbadizzleCode Nov 13, 2025
e50e310
chore: revert runner to amd
jabbadizzleCode Nov 13, 2025
22526c9
chore: revert to arm runner and build with no cache
jabbadizzleCode Nov 13, 2025
cd3cac5
chore: push arm images
jabbadizzleCode Nov 13, 2025
cd014c5
chore(deploy): use pr image tag for now
jabbadizzleCode Nov 13, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 103 additions & 0 deletions .github/workflows/v3_analytics-prd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
name: Build Docker image for analytics (prd)

on:
push:
tags: ['v*.*.*']
pull_request:
# branches: [ "v3" ]
types: [opened, synchronize, reopened, ready_for_review]
paths:
- 'apps/analytics/**'
- '.github/workflows/v3_analytics**'

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }}
cancel-in-progress: true

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}/analytics

jobs:
build-arm:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Guard skips all non-PR executions

On tag pushes (the only way this workflow should ship images) github.event.pull_request is null, so github.event.pull_request.draft == false evaluates to false and both jobs are skipped. As a result, we never build or publish production images from release tags. Please gate the draft check so it only applies to PR events.

Apply this diff in both jobs:

-  build-arm:
-    if: github.event.pull_request.draft == false
+  build-arm:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
@@
-  build-amd:
-    if: github.event.pull_request.draft == false
+  build-amd:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false

Also applies to: 64-65

🤖 Prompt for AI Agents
.github/workflows/v3_analytics-prd.yml lines 23-24 and also 64-65: the current
guard `github.event.pull_request.draft == false` fails on non-PR events because
`github.event.pull_request` is null; replace the condition so the draft check
only applies for pull_request events, e.g. use a short-circuit expression like
`github.event_name != 'pull_request' || github.event.pull_request.draft ==
false` (apply this change in both job locations).

permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v3

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Update deprecated GitHub Actions to Node 20–compatible versions.

Multiple actions are pinned to older majors targeting Node 16, which GitHub Actions no longer supports. Update to maintained majors.

Apply these updates to both build-arm and build-amd jobs:

-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5

Also applies to: 39-39, 42-42, 50-50, 55-55

🧰 Tools
🪛 actionlint (1.7.8)

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
.github/workflows/v3_analytics-prd.yml lines 30, 39, 42, 50, 55: several actions
in both build-arm and build-amd jobs are pinned to older majors that target Node
16; update each action to its current maintained major that is Node
20–compatible (for example bump actions/checkout to v4, actions/setup-node to
v4, actions/cache to its maintained major, actions/upload-artifact to its
maintained major, etc.), apply the same updates to both jobs and ensure only
maintained major version tags (not old v2/v3 pins) are used.


- name: Run util/sync-schema.sh
run: util/sync-schema.sh

- name: Set up QEMU
uses: docker/setup-qemu-action@v2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +42 to +46

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add event guard to registry login steps.

The docker/login-action steps lack the event guard present in other workflows and should skip authentication for PR builds to avoid unnecessary credential usage.

Apply this diff to both build-arm and build-amd jobs:

       - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2

Also applies to: 84-88

🧰 Tools
🪛 actionlint (1.7.8)

42-42: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
In .github/workflows/v3_analytics-prd.yml around lines 42-46 (and similarly
84-88 for the second job), the docker/login-action steps need an event guard so
they skip authentication on pull_request builds; update each docker/login-action
step in both build-arm and build-amd jobs to include an if condition that
prevents execution for PR events (e.g., if: github.event_name !=
'pull_request'), leaving the existing with: registry/username/password inputs
unchanged.


- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm

- name: Build and push Docker image
uses: docker/build-push-action@v3
with:
context: .
file: apps/analytics/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/arm64
labels: ${{ steps.meta.outputs.labels }}
build-amd:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v3

- name: Run util/sync-schema.sh
run: util/sync-schema.sh

- name: Set up QEMU
uses: docker/setup-qemu-action@v2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd

- name: Build and push Docker image
uses: docker/build-push-action@v3
with:
context: .
file: apps/analytics/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/amd64
labels: ${{ steps.meta.outputs.labels }}
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Build Docker image for analytics (QA)
name: Build Docker image for analytics (stg)

on:
push:
Expand All @@ -21,7 +21,7 @@ env:
IMAGE_NAME: ${{ github.repository }}/analytics

jobs:
build:
build-arm:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Push builds to v3* never run

Branch pushes don’t carry a pull_request payload, so github.event.pull_request.draft == false resolves to false and both staging jobs are skipped. That blocks staging image creation from the v3 branches. Please restrict the draft check to PR events only.

Apply this diff in both jobs:

-  build-arm:
-    if: github.event.pull_request.draft == false
+  build-arm:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
@@
-  build-amd:
-    if: github.event_pull_request.draft == false
+  build-amd:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false

Also applies to: 66-67

🤖 Prompt for AI Agents
.github/workflows/v3_analytics-stg.yml around lines 25-26 (and similarly lines
66-67): the workflow currently checks github.event.pull_request.draft == false
unconditionally, which fails for branch push events because there's no
pull_request payload and causes the jobs to be skipped; change the conditional
to first ensure the event is a pull_request and then check draft (e.g., guard
with github.event_name == 'pull_request' && github.event.pull_request.draft ==
false) so push events are not blocked and PRs still exclude drafts; apply the
same change to the other job at lines 66-67.

permissions:
Expand Down Expand Up @@ -51,7 +51,7 @@ jobs:
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm

- name: Build and push Docker image
uses: docker/build-push-action@v3
Expand All @@ -60,4 +60,46 @@ jobs:
file: apps/analytics/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/arm64
labels: ${{ steps.meta.outputs.labels }}
build-amd:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v3

- name: Run util/sync-schema.sh
run: util/sync-schema.sh

- name: Set up QEMU
uses: docker/setup-qemu-action@v2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd

- name: Build and push Docker image
uses: docker/build-push-action@v3
with:
context: .
file: apps/analytics/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/amd64
labels: ${{ steps.meta.outputs.labels }}
113 changes: 113 additions & 0 deletions .github/workflows/v3_auth-prd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
name: Build Docker image for auth (prd)

on:
push:
tags: ['v*.*.*']
pull_request:
# branches: [ "v3" ]
types: [opened, synchronize, reopened, ready_for_review]
paths:
- 'apps/auth/**'
- '.github/workflows/v3_auth**'

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }}
cancel-in-progress: true

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}/auth

jobs:
build-arm:
if: github.event.pull_request.draft == false

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix job guard to allow push events (CRITICAL).

The condition github.event.pull_request.draft == false evaluates to false on push events (where github.event.pull_request is unset), preventing production images from being built on tag pushes. The guard should allow non-PR events while still filtering draft PRs.

Apply this diff to both job conditions:

-    if: github.event.pull_request.draft == false
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false

Also applies to: 70-70

🤖 Prompt for AI Agents
In .github/workflows/v3_auth-prd.yml around lines 23 and 70, the job guard
currently uses "if: github.event.pull_request.draft == false" which fails on
push/tag events because github.event.pull_request is undefined; change the
condition to allow non-pull_request events while still filtering out draft PRs —
replace it with: if: github.event_name != 'pull_request' ||
github.event.pull_request.draft == false and apply the same change to both
occurrences (lines ~23 and ~70).

runs-on: ubuntu-latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Let push builds run by loosening the PR-only guard

On push events github.event.pull_request is unset, so this condition evaluates to false and the jobs are skipped—no auth images ever get built from production tags. Allow push events while still skipping draft PRs.

-    if: github.event.pull_request.draft == false
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
runs-on: ubuntu-latest
🤖 Prompt for AI Agents
In .github/workflows/v3_auth-prd.yml around lines 23-24 the job guard uses "if:
github.event.pull_request.draft == false", which evaluates to false on push
events (github.event.pull_request is unset) and prevents builds; change the
condition to allow push events while still skipping draft PRs — for example
replace it with a combined check such as "if: github.event_name == 'push' ||
(github.event_name == 'pull_request' && github.event.pull_request.draft ==
false)" so pushes run and only non-draft PRs are allowed.

permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v3

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Update deprecated actions to Node 20–compatible releases.

Multiple actions are pinned to older major versions targeting Node 16 runtime, which GitHub Actions runners no longer support. Update to the maintained majors that support Node 20.

Apply this diff to upgrade all actions:

       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3

       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3

       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5

       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6

Note: Apply these same updates to both the build-arm and build-amd jobs (lines 30–68 and 77–114 respectively).

Also applies to: 39-39, 42-42, 45-45, 53-53, 58-58, 77-77, 86-86, 89-89, 92-92, 100-100, 105-105

🧰 Tools
🪛 actionlint (1.7.8)

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
.github/workflows/v3_auth-prd.yml around line 30 (also apply same changes to
lines 39, 42, 45, 53, 58, 77, 86, 89, 92, 100, 105): several actions are pinned
to older majors that target Node 16; update each action pin to its maintained
Node 20–compatible major (for example bump actions/checkout to a current major,
bump actions/setup-node, actions/cache and any other actions used to their
latest supported major releases), and apply the same version bumps in both the
build-arm (lines ~30–68) and build-amd (lines ~77–114) job blocks so all
referenced action lines use Node 20–compatible majors.


- name: Replace .env.production with .env.prd
shell: bash
run: |
rm apps/auth/.env.production
mv apps/auth/.env.prd apps/auth/.env.production

- name: Set up QEMU
uses: docker/setup-qemu-action@v2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

Comment on lines +29 to +43

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Update deprecated Actions to maintained majors.

Align with actionlint guidance to avoid workflow breakage.

-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
@@
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
@@
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
@@
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
@@
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
@@
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6

Also applies to: 46-58, 59-69

🧰 Tools
🪛 actionlint (1.7.7)

32-32: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)


41-41: the runner of "docker/setup-qemu-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)


44-44: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
.github/workflows/v3_auth-qa-prd.yml lines 31-45 (and similarly apply to lines
46-58 and 59-69): several GitHub Actions uses are pinned to outdated/deprecated
tags; update each "uses" to the currently maintained major release (for example
replace actions/checkout@v3 with the maintained major like actions/checkout@v4,
and replace docker/setup-qemu-action@v2 and docker/setup-buildx-action@v2 with
their current maintained major tags), ensuring you only change the tag (not the
action name), test the workflow for syntax, and apply the same tag updates to
the other two affected blocks (lines 46-58 and 59-69).

- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@v2

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Guard registry login by event type to prevent PR authentication.

The login step lacks the event guard present in other workflows, which will attempt authentication on PR builds and may cause failures or credential leakage. Add the guard.

Apply this diff to both build-arm and build-amd jobs:

       - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2

Also applies to: 91-91

🧰 Tools
🪛 actionlint (1.7.8)

45-45: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
In .github/workflows/v3_auth-prd.yml around lines 45 and 91, the
docker/login-action@v2 steps are missing an event guard and will run for
pull_request events; add an if condition to each login step to skip login on PRs
by adding if: github.event_name != 'pull_request' to both the build-arm and
build-amd job docker/login-action steps so registry authentication only runs on
non-PR events.

with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +44 to +49

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add event guard to registry login steps.

The docker/login-action steps lack the event guard present in the build-push steps. Registry authentication should skip PR builds to prevent unnecessary credential usage and potential exposure.

Apply this diff to both login steps:

       - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}

Also applies to: 91-96

🧰 Tools
🪛 actionlint (1.7.8)

45-45: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents
.github/workflows/v3_auth-prd.yml around lines 44-49 and 91-96: the
docker/login-action steps currently run for PRs and should be skipped for
pull_request events; add the same event guard used on the build-push steps by
adding an if condition (e.g., if: github.event_name != 'pull_request') to each
docker/login-action step so registry login is skipped for PR builds and mirrors
the build-push behavior.


- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm

- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
file: apps/auth/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/arm64
labels: ${{ steps.meta.outputs.labels }}
build-args: |
NEXT_PUBLIC_ENV=${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }}
build-amd:
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v3

- name: Replace .env.production with .env.prd
shell: bash
run: |
rm apps/auth/.env.production
mv apps/auth/.env.prd apps/auth/.env.production

- name: Set up QEMU
uses: docker/setup-qemu-action@v2

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd

- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
file: apps/auth/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/amd64
labels: ${{ steps.meta.outputs.labels }}
build-args: |
NEXT_PUBLIC_ENV=${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }}
68 changes: 0 additions & 68 deletions .github/workflows/v3_auth-qa.yml

This file was deleted.

Loading
Loading