OpenConceptLab/ocl_online#465 | AutoMatch dialog: first run includes the OCL AI Assistant, notices in a footer, and a checkpoint

.github/workflows/build.yml

@@ -81,8 +81,64 @@ jobs:
         cache-from: type=gha
         cache-to: type=gha,mode=max
 
+  # The image the deploy jobs below run: the open build plus a private UI
+  # package, pushed only to the private ECR repository. Docker Hub gets the
+  # open image above. The private-packages environment holds the deploy key
+  # and PRIVATE_PACKAGES_GIT, and only main may use it. No cache is written,
+  # so no layer with the package lands in this repo's Actions cache.
+  build-private:
+    needs: [lint-and-test]
+    name: Build and push deploy image
+    runs-on: ubuntu-latest
+    environment: private-packages
+
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@v3
+    - name: Compute version and short sha
+      id: version
+      run: |
+        echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
+        echo "sha=$(bash release_version.sh sha)" >> $GITHUB_OUTPUT
+    - name: Fail without the private package settings
+      env:
+        HAS_KEY: ${{ secrets.PRIVATE_GIT_PACKAGES_DEPLOY_KEY != '' }}
+        HAS_SPEC: ${{ secrets.PRIVATE_PACKAGES_GIT != '' }}
+      run: |
+        if [ "$HAS_KEY" != "true" ] || [ "$HAS_SPEC" != "true" ]; then
+          echo "::error::Set PRIVATE_GIT_PACKAGES_DEPLOY_KEY and PRIVATE_PACKAGES_GIT in the private-packages environment."
+          exit 1
+        fi
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ env.AWS_REGION }}
+    - name: Login to Amazon ECR
+      id: login-ecr
+      uses: aws-actions/amazon-ecr-login@v1
+    - name: Setup SSH agent
+      uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
+      with:
+        ssh-private-key: ${{ secrets.PRIVATE_GIT_PACKAGES_DEPLOY_KEY }}
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build and push deploy image
+      uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+      with:
+        context: .
+        push: true
+        ssh: default
+        provenance: false
+        tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.version.outputs.tag }}
+        build-args: |
+          SOURCE_COMMIT=${{ steps.version.outputs.sha }}
+          PRIVATE_PACKAGES_GIT=${{ secrets.PRIVATE_PACKAGES_GIT }}
+        cache-from: type=gha
+
   release:
-    needs: [build]
+    needs: [build, build-private]
     runs-on: ubuntu-latest
     name: Release
     environment: rc
@@ -126,13 +182,11 @@ jobs:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: ${{ steps.version.outputs.tag }}
         run: |
-          # Build a docker container and
-          # push it to ECR so that it can
+          # Tag the image build-private pushed to ECR
+          # for this environment, so that it can
           # be deployed to ECS.
-          docker pull openconceptlab/oclmap:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:dev
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:dev
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:dev
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
       - name: Download task definition
@@ -179,13 +233,11 @@ jobs:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: ${{ steps.version.outputs.tag }}
         run: |
-          # Build a docker container and
-          # push it to ECR so that it can
+          # Tag the image build-private pushed to ECR
+          # for this environment, so that it can
           # be deployed to ECS.
-          docker pull openconceptlab/oclmap:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:qa
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:qa
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:qa
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
       - name: Download task definition
@@ -232,11 +284,11 @@ jobs:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: ${{ steps.version.outputs.tag }}
         run: |
-          # Build a docker container and
-          # push it to ECR so that it can
+          # Tag the image build-private pushed to ECR
+          # for this environment, so that it can
           # be deployed to ECS.
-          docker pull openconceptlab/oclmap:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:staging
+          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:staging
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:staging
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
       - name: Download task definition
@@ -283,11 +335,11 @@ jobs:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: ${{ steps.version.outputs.tag }}
         run: |
-          # Build a docker container and
-          # push it to ECR so that it can
+          # Tag the image build-private pushed to ECR
+          # for this environment, so that it can
           # be deployed to ECS.
-          docker pull openconceptlab/oclmap:$IMAGE_TAG
-          docker tag openconceptlab/oclmap:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:production
+          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:production
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:production
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
       - name: Download task definition

Dockerfile

@@ -27,6 +27,22 @@ ADD package-lock.json /app/
 
 RUN npm ci --production=false
 
+# OPTIONAL: install a private UI package during image build
+# PRIVATE_PACKAGES_GIT is an npm install spec, e.g. a git+ssh URL. The package
+# fills webpack.config.js's checkpoints; the build fails if it doesn't land.
+# GitHub's SSH host keys are pinned (https://api.github.com/meta).
+ARG PRIVATE_PACKAGES_GIT
+ARG SOURCE_COMMIT
+RUN --mount=type=ssh \
+  if [ -n "$PRIVATE_PACKAGES_GIT" ]; then \
+    mkdir -p /root/.ssh && \
+    echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> /root/.ssh/known_hosts && \
+    echo "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=" >> /root/.ssh/known_hosts && \
+    echo "Installing private UI packages (oclmap commit $SOURCE_COMMIT)" && \
+    npm i $PRIVATE_PACKAGES_GIT --no-save --ignore-scripts --production=false && \
+    node -e "const p = require('./node_modules/.package-lock.json').packages['node_modules/@openconceptlab/oclmap-extensions']; if(!p) { console.error('The private UI package did not install as @openconceptlab/oclmap-extensions'); process.exit(1) } console.log('Installed', p.version, p.resolved)"; \
+  fi
+
 ADD webpack.config.js /app/
 ADD .babelrc /app/
 ADD src /app/src/

docker-compose.override.yml

@@ -8,6 +8,7 @@ services:
       target: build
       args:
         NODE_ENV: development
+        PRIVATE_PACKAGES_GIT:
     ports:
       - "4004:4004"
       - "4005:35729"

docker-compose.sso.yml

@@ -8,6 +8,7 @@ services:
       target: build
       args:
         NODE_ENV: development
+        PRIVATE_PACKAGES_GIT:
     ports:
       - "4004:4004"
       - "4005:35729"

docker-compose.yml

@@ -7,6 +7,7 @@ services:
       context: .
       args:
         NODE_ENV: production
+        PRIVATE_PACKAGES_GIT:
     ports:
       - "4004:4004"
     restart: on-failure