Skip to content

feat(orion): surface VM image, resources, and toolchain in Client UI #2160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
genedna merged 3 commits into from
Jul 29, 2026
Merged

feat(orion): surface VM image, resources, and toolchain in Client UI #2160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b33c405
feat(orion): surface VM image, resources, and toolchain in Client UI
benjamin-747 Jul 29, 2026
2b2e960
chore(ci): temporarily disable AWS ECR image pushes
benjamin-747 Jul 29, 2026
e50b07b
feat(orion): keep runner VMs listed on /oc
benjamin-747 Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 27 additions & 9 deletions .github/workflows/mono-engine-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ env:
REPOSITORY: mega/mono-engine
IMAGE_TAG_BASE: latest
HARBOR_REGISTRY: registry.xuanwu.openatom.cn
# TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore.
PUSH_AWS_ECR: "false"

# Using AWS access key for authentication.
# actions: write is required for docker buildx --cache-{from,to} type=gha.
Expand Down Expand Up @@ -50,16 +52,18 @@ jobs:
uses: crazy-max/ghaction-github-runtime@v3

# -----------------------------
# AWS / ECR Public
# AWS / ECR Public (TEMP disabled)
# -----------------------------
- name: Configure AWS Credentials
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -73,23 +77,31 @@ jobs:
password: ${{ secrets.HARBOR_PASSWORD }}

# -----------------------------
# Build & push to ECR + Harbor
# Build & push (Harbor; ECR when PUSH_AWS_ECR=true)
# -----------------------------
- name: Build & push image to ECR and Harbor (amd64)
- name: Build & push image (amd64)
env:
ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
IMAGE_TAG_BASE: ${{ env.IMAGE_TAG_BASE }}
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail

ARCH_SUFFIX=amd64
IMAGE_TAG="${IMAGE_TAG_BASE}-${ARCH_SUFFIX}"

ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
CACHE_SCOPE="mono-engine-${ARCH_SUFFIX}"

echo "ECR_IMAGE=$ECR_IMAGE"
TAGS=(-t "$HARBOR_IMAGE")
if [ "$PUSH_AWS_ECR" = "true" ]; then
ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
echo "ECR_IMAGE=$ECR_IMAGE"
TAGS+=(-t "$ECR_IMAGE")
else
echo "TEMP: skipping AWS ECR push (Harbor only)"
fi

echo "HARBOR_IMAGE=$HARBOR_IMAGE"
echo "CACHE_SCOPE=$CACHE_SCOPE"

Expand All @@ -99,8 +111,7 @@ jobs:
--provenance=false \
--sbom=false \
-f ./mono/Dockerfile \
-t "$ECR_IMAGE" \
-t "$HARBOR_IMAGE" \
"${TAGS[@]}" \
--push .

manifest:
Expand All @@ -110,13 +121,15 @@ jobs:
contents: read
steps:
- name: Configure AWS Credentials
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -132,9 +145,9 @@ jobs:
- name: Create & push manifest
env:
REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail
IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
SHORT_SHA="${GITHUB_SHA:0:7}"
TAG_BASE="${{ env.IMAGE_TAG_BASE }}"
Expand All @@ -155,7 +168,12 @@ jobs:
docker manifest push "$base:$SHORT_SHA"
}

push_manifests "$IMAGE_BASE"
if [ "$PUSH_AWS_ECR" = "true" ]; then
IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
push_manifests "$IMAGE_BASE"
else
echo "TEMP: skipping AWS ECR manifests (Harbor only)"
fi
push_manifests "$HARBOR_BASE"

deploy-aws:
Expand Down
34 changes: 26 additions & 8 deletions .github/workflows/orion-server-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ env:
REPOSITORY: mega/orion-server
IMAGE_TAG_BASE: latest
HARBOR_REGISTRY: registry.xuanwu.openatom.cn
# TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore.
PUSH_AWS_ECR: "false"

# actions: write is required for docker buildx --cache-{from,to} type=gha.
permissions:
Expand Down Expand Up @@ -44,16 +46,18 @@ jobs:
uses: crazy-max/ghaction-github-runtime@v3

# -----------------------------
# AWS auth
# AWS auth (TEMP disabled)
# -----------------------------
- name: Configure AWS Credentials
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -67,32 +71,39 @@ jobs:
password: ${{ secrets.HARBOR_PASSWORD }}

# -----------------------------
# Build & push to AWS + Harbor
# Build & push (Harbor; ECR when PUSH_AWS_ECR=true)
# -----------------------------
- name: Build & push amd64 image to AWS and Harbor
- name: Build & push amd64 image
env:
AWS_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail

PLATFORM="linux/amd64"
ARCH_SUFFIX="amd64"

AWS_IMAGE_BASE="$AWS_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"

TAG="${{ env.IMAGE_TAG_BASE }}-$ARCH_SUFFIX"
CACHE_SCOPE="orion-server-$ARCH_SUFFIX"

TAGS=(-t "$HARBOR_IMAGE_BASE:$TAG")
if [ "$PUSH_AWS_ECR" = "true" ]; then
AWS_IMAGE_BASE="$AWS_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
TAGS+=(-t "$AWS_IMAGE_BASE:$TAG")
else
echo "TEMP: skipping AWS ECR push (Harbor only)"
fi

docker buildx build \
--platform "$PLATFORM" \
--cache-from type=gha,scope=$CACHE_SCOPE \
--cache-to type=gha,mode=max,scope=$CACHE_SCOPE \
--provenance=false \
--sbom=false \
-f orion-server/Dockerfile \
-t "$AWS_IMAGE_BASE:$TAG" \
-t "$HARBOR_IMAGE_BASE:$TAG" \
"${TAGS[@]}" \
--push .

manifest:
Expand All @@ -102,13 +113,15 @@ jobs:
contents: read
steps:
- name: Configure AWS Credentials
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -124,9 +137,9 @@ jobs:
- name: Create & push manifest
env:
REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail
IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
SHORT_SHA="${GITHUB_SHA:0:7}"
TAG_BASE="${{ env.IMAGE_TAG_BASE }}"
Expand All @@ -147,7 +160,12 @@ jobs:
docker manifest push "$base:$SHORT_SHA"
}

push_manifests "$IMAGE_BASE"
if [ "$PUSH_AWS_ECR" = "true" ]; then
IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
push_manifests "$IMAGE_BASE"
else
echo "TEMP: skipping AWS ECR manifests (Harbor only)"
fi
push_manifests "$HARBOR_BASE"

deploy-aws:
Expand Down
32 changes: 24 additions & 8 deletions .github/workflows/web-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ env:
REPOSITORY: mega/mega-ui
IMAGE_VERSION: latest
HARBOR_REGISTRY: registry.xuanwu.openatom.cn
# TEMP: skip AWS ECR Public push; Harbor only. Re-enable ECR steps below to restore.
PUSH_AWS_ECR: "false"

# actions: write is required for docker buildx --cache-{from,to} type=gha.
permissions:
Expand Down Expand Up @@ -54,13 +56,15 @@ jobs:
uses: crazy-max/ghaction-github-runtime@v3

- name: Configure AWS Credentials (ECR Public, us-east-1)
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -78,18 +82,26 @@ jobs:
env:
ECR_PUBLIC_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
PLATFORM: linux/amd64
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail
ARCH_SUFFIX="amd64"
IMAGE_TAG="${IMAGE_VERSION}-${ARCH_SUFFIX}"
SHORT_SHA="${GITHUB_SHA:0:7}"
SHA_TAG="${SHORT_SHA}-${ARCH_SUFFIX}"

PUBLIC_IMAGE="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
PUBLIC_IMAGE_SHA="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$SHA_TAG"
HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
HARBOR_IMAGE_SHA="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$SHA_TAG"

TAGS=(-t "$HARBOR_IMAGE" -t "$HARBOR_IMAGE_SHA")
if [ "$PUSH_AWS_ECR" = "true" ]; then
PUBLIC_IMAGE="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
PUBLIC_IMAGE_SHA="$ECR_PUBLIC_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$SHA_TAG"
TAGS+=(-t "$PUBLIC_IMAGE" -t "$PUBLIC_IMAGE_SHA")
else
echo "TEMP: skipping AWS ECR push (Harbor only)"
fi

docker buildx build \
--platform "$PLATFORM" \
--build-arg TIPTAP_PRIVATE_REGISTRY_KEY="$TIPTAP_PRIVATE_REGISTRY_KEY" \
Expand All @@ -98,10 +110,7 @@ jobs:
--provenance=false \
--sbom=false \
-f apps/web/Dockerfile \
-t "$PUBLIC_IMAGE" \
-t "$PUBLIC_IMAGE_SHA" \
-t "$HARBOR_IMAGE" \
-t "$HARBOR_IMAGE_SHA" . \
"${TAGS[@]}" . \
--push

manifest:
Expand All @@ -111,13 +120,15 @@ jobs:
contents: read
steps:
- name: Configure AWS Credentials
if: env.PUSH_AWS_ECR == 'true'
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Login to Amazon ECR Public
if: env.PUSH_AWS_ECR == 'true'
id: login-ecr-public
uses: aws-actions/amazon-ecr-login@v2
with:
Expand All @@ -133,10 +144,10 @@ jobs:
- name: Create & push unified manifest
env:
REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
PUSH_AWS_ECR: ${{ env.PUSH_AWS_ECR }}
run: |
set -euo pipefail

IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
TAG="${IMAGE_VERSION}"
SHORT_SHA="${GITHUB_SHA:0:7}"
Expand All @@ -152,7 +163,12 @@ jobs:
docker manifest push "$base:$SHORT_SHA"
}

push_manifests "$IMAGE_BASE"
if [ "$PUSH_AWS_ECR" = "true" ]; then
IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
push_manifests "$IMAGE_BASE"
else
echo "TEMP: skipping AWS ECR manifests (Harbor only)"
fi
push_manifests "$HARBOR_BASE"

deploy-aws:
Expand Down
Loading
Loading