ibm-cloud-code-engine.yml

# ===============================================================
# ☁️  MCP Gateway ▸ Build, Cache & Deploy to IBM Code Engine
# ===============================================================
#
# This workflow:
#   - Restores / updates a local **BuildKit layer cache**  ❄️
#   - Builds the Docker image from **Containerfile.lite**  🏗️
#   - Pushes the image to **IBM Container Registry (ICR)** 📤
#   - Creates / updates an **IBM Cloud Code Engine** app   🚀
#
# ---------------------------------------------------------------
# Required repository **secret**
# ---------------------------------------------------------------
#  ┌────────────────────┬──────────────────────────────────────┐
#  │ Secret name        │ Example value                        │
#  ├────────────────────┼──────────────────────────────────────┤
#  │ IBM_CLOUD_API_KEY  │ abcdef-1234567890abcdef-1234567890   │
#  └────────────────────┴──────────────────────────────────────┘
#
# ---------------------------------------------------------------
# Required repository **variables**
# ---------------------------------------------------------------
#  ┌────────────────────────────┬──────────────────────────────┐
#  │ Variable name              │ Example value                │
#  ├────────────────────────────┼──────────────────────────────┤
#  │ IBM_CLOUD_REGION           │ us-south                     │
#  │ REGISTRY_HOSTNAME          │ us.icr.io                    │
#  │ ICR_NAMESPACE              │ myspace                      │
#  │ APP_NAME                   │ mcpgateway                   │
#  │ CODE_ENGINE_PROJECT        │ my-ce-project                │
#  │ CODE_ENGINE_REGISTRY_SECRET│ my-registry-secret           │
#  │ CODE_ENGINE_PORT           │ "4444"                       │
#  └────────────────────────────┴──────────────────────────────┘
# * Note: CODE_ENGINE_REGISTRY_SECRET is the name of the secret,
#         not the secret value.
# Triggers:
#   - Every push to `main`
#   - Expects a secret called `mcpgateway-dev` in Code Engine. Ex:
#      ibmcloud ce secret create \
#        --name mcpgateway-dev \
#        --from-env-file .env
# ---------------------------------------------------------------

name: Deploy to IBM Code Engine

on:
  push:
    branches: ["main"]

# -----------------------------------------------------------------
# Minimal permissions (Principle of Least Privilege)
# -----------------------------------------------------------------
permissions:
  contents: read

# -----------------------------------------------------------------
# Global environment (secrets & variables)
# -----------------------------------------------------------------
env:
  # Build metadata
  GITHUB_SHA: ${{ github.sha }}
  CACHE_DIR: /tmp/.buildx-cache # BuildKit layer cache dir

  # IBM Cloud region (variable)
  IBM_CLOUD_REGION: ${{ vars.IBM_CLOUD_REGION }}

  # Registry coordinates (variables)
  REGISTRY_HOSTNAME: ${{ vars.REGISTRY_HOSTNAME }}
  ICR_NAMESPACE: ${{ vars.ICR_NAMESPACE }}

  # Image / app naming (variables)
  IMAGE_NAME: ${{ vars.APP_NAME }}
  IMAGE_TAG: ${{ github.sha }}

  # Code Engine deployment (variables)
  CODE_ENGINE_APP_NAME: ${{ vars.APP_NAME }}
  CODE_ENGINE_PROJECT: ${{ vars.CODE_ENGINE_PROJECT }}
  CODE_ENGINE_REGISTRY_SECRET: ${{ vars.CODE_ENGINE_REGISTRY_SECRET }}
  PORT: ${{ vars.CODE_ENGINE_PORT }}

jobs:
  build-push-deploy:
    name: 🚀 Build, Cache, Push & Deploy
    runs-on: ubuntu-latest
    environment: production

    steps:
      # -----------------------------------------------------------
      # 0️⃣  Checkout repository
      # -----------------------------------------------------------
      - name: ⬇️  Checkout source
        uses: actions/checkout@v5

      # -----------------------------------------------------------
      # 1️⃣  Set up Docker Buildx
      # -----------------------------------------------------------
      - name: 🛠️  Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.11.1

      # -----------------------------------------------------------
      # 2️⃣  Restore BuildKit layer cache
      # -----------------------------------------------------------
      - name: 🔄  Restore BuildKit cache
        uses: actions/cache@v4
        with:
          path: ${{ env.CACHE_DIR }}
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: ${{ runner.os }}-buildx-

      # -----------------------------------------------------------
      # 3️⃣  Install IBM Cloud CLI + plugins & login
      # -----------------------------------------------------------
      - name: 🧰  Install IBM Cloud CLI
        uses: IBM/actions-ibmcloud-cli@v1
        with:
          api_key: ${{ secrets.IBM_CLOUD_API_KEY }}
          region: ${{ vars.IBM_CLOUD_REGION }}
          plugins: container-registry, code-engine

      # -----------------------------------------------------------
      # 4️⃣  Authenticate to IBM Cloud Code Engine project
      # -----------------------------------------------------------
      - name: 🔐  IBM Cloud Code Engine login
        run: |
          ibmcloud cr region-set "$IBM_CLOUD_REGION"
          ibmcloud cr login
          ibmcloud ce project select --name "$CODE_ENGINE_PROJECT"

      # -----------------------------------------------------------
      # 5️⃣  Build & tag image (cache-aware, amd64 platform)
      # -----------------------------------------------------------
      - name: 🏗️  Build Docker image (with cache)
        run: |
          docker buildx build \
            --platform linux/amd64 \
            --file Containerfile.lite \
            --tag "$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$IMAGE_TAG" \
            --cache-from type=local,src=${{ env.CACHE_DIR }} \
            --cache-to   type=local,dest=${{ env.CACHE_DIR }},mode=max \
            --load \
            .

      # -----------------------------------------------------------
      # 6️⃣  Push image to IBM Container Registry
      # -----------------------------------------------------------
      - name: 📤  Push image to ICR
        run: |
          docker push "$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$IMAGE_TAG"

      # -----------------------------------------------------------
      # 7️⃣  Deploy (create or update) Code Engine application
      # -----------------------------------------------------------
      - name: 🚀  Deploy to Code Engine
        run: |
          if ibmcloud ce application get --name "$CODE_ENGINE_APP_NAME" > /dev/null 2>&1; then
            echo "🔁 Updating existing application..."
            ibmcloud ce application update \
              --name  "$CODE_ENGINE_APP_NAME" \
              --image "$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$IMAGE_TAG" \
              --registry-secret "$CODE_ENGINE_REGISTRY_SECRET" \
              --env-from-secret mcpgateway-dev \
              --cpu 1 --memory 2G
          else
            echo "🆕 Creating new application..."
            ibmcloud ce application create \
              --name  "$CODE_ENGINE_APP_NAME" \
              --image "$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$IMAGE_TAG" \
              --registry-secret "$CODE_ENGINE_REGISTRY_SECRET" \
              --port  "$PORT" \
              --env-from-secret mcpgateway-dev \
              --cpu 1 --memory 2G
          fi

      # -----------------------------------------------------------
      # 8️⃣  Show deployment status
      # -----------------------------------------------------------
      - name: 📈  Display deployment status
        run: ibmcloud ce application get --name "$CODE_ENGINE_APP_NAME"