ci: restore manual plugin deploys

.github/workflows/deploy.yml

@@ -3,25 +3,37 @@ name: Main Deploy
 on:
   push:
     branches: [ main ]
+  workflow_dispatch:
+    inputs:
+      commit_sha:
+        description: 'Commit SHA to deploy (defaults to the selected ref)'
+        required: false
+        type: string
+      service:
+        description: 'Service to deploy (leave empty to deploy all services)'
+        required: false
+        type: string
 
 concurrency:
-  group: main-deploy
+  group: deploy-${{ github.event_name == 'workflow_dispatch' && (inputs.service || 'manual') || 'main' }}
   cancel-in-progress: false
 
 jobs:
-  # Detect the services with app-local changes in this push.
-  changes:
-    name: Detect changed services
+  # Select changed services on main pushes, or manually requested services.
+  services:
+    name: Select services
     runs-on: ubuntu-latest
     outputs:
       services: ${{ steps.setup-services.outputs.services }}
       has_services: ${{ steps.setup-services.outputs.has_services }}
+      deploy_sha: ${{ steps.deploy-ref.outputs.deploy_sha }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Detect changed apps
         id: changed-apps
+        if: ${{ github.event_name == 'push' }}
         uses: dorny/paths-filter@v4
         with:
           base: ${{ github.ref }}
@@ -49,31 +61,133 @@ jobs:
             anti-abuse-oracle:
               - 'apps/anti-abuse-oracle/**'
 
-      - name: Setup changed services matrix
+      - name: Select services input
+        id: services-input
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          MANUAL_SERVICE: ${{ github.event_name == 'workflow_dispatch' && inputs.service || '' }}
+          CHANGED_SERVICES: ${{ steps.changed-apps.outputs.changes }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            if [ -n "$MANUAL_SERVICE" ]; then
+              SERVICES=$(jq -c -n --arg service "$MANUAL_SERVICE" '[$service]')
+            else
+              SERVICES=$(jq -c . .github/config/services.json)
+            fi
+          else
+            SERVICES="${CHANGED_SERVICES:-[]}"
+          fi
+
+          echo "services=$SERVICES" >> "$GITHUB_OUTPUT"
+
+      - name: Setup services matrix
         id: setup-services
         uses: ./.github/actions/setup-services-matrix
         with:
-          services: ${{ steps.changed-apps.outputs.changes }}
-
-  # First build the changed services
-  build:
-    needs: changes
-    if: ${{ needs.changes.outputs.has_services == 'true' }}
-    uses: ./.github/workflows/build-services.yml
-    with:
-      tag: ${{ github.sha }}
-      services: ${{ needs.changes.outputs.services }}
-    secrets: inherit
-
-  # Then publish the changed multiarch images to the release tags used by k8s.
+          services: ${{ steps.services-input.outputs.services }}
+
+      - name: Select deploy ref
+        id: deploy-ref
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          MANUAL_COMMIT_SHA: ${{ github.event_name == 'workflow_dispatch' && inputs.commit_sha || '' }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -n "$MANUAL_COMMIT_SHA" ]; then
+            DEPLOY_SHA="$MANUAL_COMMIT_SHA"
+          else
+            DEPLOY_SHA="$GITHUB_SHA"
+          fi
+
+          echo "deploy_sha=$DEPLOY_SHA" >> "$GITHUB_OUTPUT"
+
+  build-amd64:
+    name: Build ${{ matrix.service }} (amd64)
+    if: ${{ needs.services.outputs.has_services == 'true' }}
+    runs-on: ubuntu-latest
+    needs: services
+    strategy:
+      matrix:
+        service: ${{ fromJson(needs.services.outputs.services) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.services.outputs.deploy_sha }}
+
+      - name: Build Docker Image
+        uses: ./.github/actions/build-docker-image
+        with:
+          service_name: ${{ matrix.service }}
+          tag: ${{ needs.services.outputs.deploy_sha }}-amd64
+          platform: linux/amd64
+          docker_username: ${{ secrets.DOCKER_USERNAME }}
+          docker_password: ${{ secrets.DOCKER_PASSWORD }}
+
+  build-arm64:
+    name: Build ${{ matrix.service }} (arm64)
+    if: ${{ needs.services.outputs.has_services == 'true' }}
+    runs-on: ubuntu-24.04-arm
+    needs: services
+    strategy:
+      matrix:
+        service: ${{ fromJson(needs.services.outputs.services) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.services.outputs.deploy_sha }}
+
+      - name: Build Docker Image
+        uses: ./.github/actions/build-docker-image
+        with:
+          service_name: ${{ matrix.service }}
+          tag: ${{ needs.services.outputs.deploy_sha }}-arm64
+          platform: linux/arm64
+          docker_username: ${{ secrets.DOCKER_USERNAME }}
+          docker_password: ${{ secrets.DOCKER_PASSWORD }}
+
+  create-multiarch:
+    name: Create multiarch manifest for ${{ matrix.service }}
+    if: ${{ needs.services.outputs.has_services == 'true' }}
+    runs-on: ubuntu-latest
+    needs: [services, build-amd64, build-arm64]
+    strategy:
+      matrix:
+        service: ${{ fromJson(needs.services.outputs.services) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker Login
+        uses: ./.github/actions/docker-login
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Create multiarch manifest
+        run: |
+          REPO="audius/${{ matrix.service }}"
+          TAG_SUFFIX="${{ needs.services.outputs.deploy_sha }}"
+          AMD64_TAG="${REPO}:${TAG_SUFFIX}-amd64"
+          ARM64_TAG="${REPO}:${TAG_SUFFIX}-arm64"
+          MULTIARCH_TAG="${REPO}:${TAG_SUFFIX}"
+
+          docker buildx imagetools create \
+            "$AMD64_TAG" \
+            "$ARM64_TAG" \
+            --tag "$MULTIARCH_TAG"
+
   publish:
     name: Publish ${{ matrix.service }}
     runs-on: ubuntu-latest
-    needs: [changes, build]
-    if: ${{ needs.changes.outputs.has_services == 'true' }}
+    needs: [services, create-multiarch]
+    if: ${{ needs.services.outputs.has_services == 'true' }}
     strategy:
       matrix:
-        service: ${{ fromJson(needs.changes.outputs.services) }}
+        service: ${{ fromJson(needs.services.outputs.services) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -87,5 +201,5 @@ jobs:
       - name: Publish release tags
         run: |
           REPO="audius/${{ matrix.service }}"
-          SOURCE_TAG="${REPO}:${{ github.sha }}"
+          SOURCE_TAG="${REPO}:${{ needs.services.outputs.deploy_sha }}"
           docker buildx imagetools create "$SOURCE_TAG" --tag "${REPO}:edge" --tag "${REPO}:latest"

BUILD.md

@@ -18,7 +18,7 @@ npm run docker:verified-notifications
 
 ### CI/CD
 
-The GitHub Action automatically builds changed apps on push to `main` and all apps on PRs to `main`. Each app is built in parallel as a separate job, so failures are isolated.
+The GitHub Action automatically builds changed apps on push to `main`. It can also be run manually for one app or all configured apps. Each app is built in parallel as a separate job, so failures are isolated.
 
 ## Available Commands
 
@@ -92,7 +92,7 @@ npm run docker:archiver            # Build archiver
 - Each app builds as a separate GitHub Actions job
 - Failures are isolated - one app failing doesn't affect others
 - Pushes to `main` build only apps with changes under their `apps/<app>` directory, then publish those images as both `edge` and `latest`
-- PRs to `main` build all configured apps
+- Manual runs can deploy a specific app by setting `service`, or all configured apps by leaving `service` empty
 
 ## Troubleshooting