tracer-cloud--opensre/.github/workflows/benchmark-promote-image.yml

name: Benchmark image — promote tag to task definition (any adapter)

# Adapter-agnostic image promotion. Rebinds the ECS task definition to
# a specific image tag. The image carries every registered adapter; the
# config supplied to ``benchmark-run.yml`` picks which one runs.
#
# Manually-triggered workflow that runs `terraform apply -var=image_tag=<TAG>`
# in tests/benchmarks/cloudopsbench/infra/ to register a new ECS task definition revision pointing at
# the chosen ECR image. This is the privileged "deploy" step that comes
# between an image push (automatic) and a bench run (manual).
#
# Why not auto-promote on every image push? An image build is a code-change
# event. A task-def update is a deploy event. Decoupling them lets you
# stage many images and choose deliberately which one production runs.
#
# Trigger from the GitHub UI:
#   Actions → "Benchmark image — promote tag to task definition" → Run
#
# Pre-reqs (one-time):
#   - tests/benchmarks/cloudopsbench/infra/ Terraform applied at least once. The opensre-bench-github-actions
#     OIDC role's permissions (ecs:RegisterTaskDefinition, state-bucket read/write,
#     lock-table read/write, iam:PassRole) are granted by the github_actions_run_bench
#     inline policy in tests/benchmarks/cloudopsbench/infra/iam_oidc.tf — any apply of that module attaches them.
#   - Repo secrets seeded into AWS Secrets Manager
#   - Repo vars set (AWS_ACCOUNT_ID etc., see tests/benchmarks/cloudopsbench/infra/AWS_BENCH_SETUP.md step 4)

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: 'ECR image tag to promote (e.g. 3792493)'
        required: true

permissions:
  contents: read
  id-token: write           # required for AWS OIDC role assumption

concurrency:
  group: benchmark-promote-image
  cancel-in-progress: false

jobs:
  promote:
    name: terraform apply image_tag=${{ inputs.image_tag }}
    if: github.repository == 'Tracer-Cloud/opensre'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      AWS_REGION: us-east-1

    steps:
      - name: Verify required repo variables
        env:
          AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }}
        run: |
          if [ -z "${AWS_ACCOUNT_ID:-}" ]; then
            echo "::error::Missing repo variable AWS_ACCOUNT_ID. See tests/benchmarks/cloudopsbench/infra/AWS_BENCH_SETUP.md."
            exit 1
          fi

      - uses: actions/checkout@v5

      - name: Configure AWS credentials (OIDC role assumption)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/opensre-bench-github-actions
          role-session-name: bench-promote-${{ github.run_id }}
          aws-region: us-east-1

      - name: Verify image tag exists in ECR
        # Fail loudly if the operator typos the tag, before Terraform tries
        # to register a task definition pointing at a missing image.
        env:
          IMAGE_TAG: ${{ inputs.image_tag }}
        run: |
          if ! aws ecr describe-images \
                --repository-name opensre-bench \
                --image-ids imageTag="$IMAGE_TAG" \
                >/dev/null 2>&1; then
            echo "::error::Image tag $IMAGE_TAG not found in ECR repo opensre-bench."
            echo "::error::Push it first via 'Benchmark image — build + push to ECR'."
            exit 1
          fi

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.5

      - name: Terraform init
        working-directory: tests/benchmarks/cloudopsbench/infra
        run: terraform init -input=false

      - name: Terraform apply
        # Plan is captured in the workflow log; review it in the run page.
        # -auto-approve is intentional — this workflow IS the human approval
        # (the operator triggered it manually with a specific tag).
        #
        # -target=aws_ecs_task_definition.bench scopes apply to the task
        # definition (and its data-source / role dependencies) only. Without
        # this, every dispatch tries to reconcile every resource in the
        # module — IAM, S3, ECR, etc. — against whatever ref the workflow
        # was dispatched from. Out-of-band local applies cause that
        # reconciliation to attempt rollbacks the workflow role isn't
        # permitted to perform (iam:DetachRolePolicy, iam:PutRolePolicy),
        # failing the run even when the task-def update itself succeeded.
        working-directory: tests/benchmarks/cloudopsbench/infra
        env:
          IMAGE_TAG: ${{ inputs.image_tag }}
        run: |
          terraform apply -input=false -auto-approve \
            -target=aws_ecs_task_definition.bench \
            -var="image_tag=$IMAGE_TAG"

      - name: Surface the new task definition revision in the job summary
        working-directory: tests/benchmarks/cloudopsbench/infra
        env:
          IMAGE_TAG: ${{ inputs.image_tag }}
        run: |
          TASK_DEF_ARN=$(terraform output -raw task_definition_arn)
          IMAGE_URI=$(aws ecs describe-task-definition \
            --task-definition "$TASK_DEF_ARN" \
            --query 'taskDefinition.containerDefinitions[0].image' \
            --output text)
          {
            echo "## Image promoted"
            echo ""
            echo "- Promoted tag: \`$IMAGE_TAG\`"
            echo "- New task definition ARN: \`$TASK_DEF_ARN\`"
            echo "- Image now in task definition: \`$IMAGE_URI\`"
            echo ""
            echo "### Next step"
            echo ""
            echo "Trigger **Benchmark — run on Fargate** to launch a run against this image."
          } >> "$GITHUB_STEP_SUMMARY"