Shipping It

# syntax=docker/dockerfile:1
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

# Project files first: this layer is reused until a package reference changes.
COPY Directory.Packages.props Directory.Build.props global.json ./
COPY src/Orders.Api/Orders.Api.csproj src/Orders.Api/
RUN dotnet restore src/Orders.Api/Orders.Api.csproj

COPY src/ src/
RUN dotnet publish src/Orders.Api/Orders.Api.csproj --no-restore -o /app

FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled AS final
WORKDIR /app
COPY --from=build /app .
USER $APP_UID
EXPOSE 8080
ENTRYPOINT ["dotnet", "Orders.Api.dll"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
spec:
  replicas: 3
  strategy:
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  selector:
    matchLabels: { app: orders-api }
  template:
    metadata:
      labels: { app: orders-api }
    spec:
      terminationGracePeriodSeconds: 40
      securityContext: { runAsNonRoot: true }
      containers:
        - name: api
          image: registry.example.com/shop/orders-api:3f9c2d1
          ports: [{ containerPort: 8080 }]
          env:
            - { name: ASPNETCORE_ENVIRONMENT, value: Production }
            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: "http://otel-collector.observability:4317" }
            - name: ConnectionStrings__Orders
              valueFrom: { secretKeyRef: { name: orders-db, key: connection-string } }
          resources:
            requests: { cpu: 250m, memory: 256Mi }
            limits: { memory: 512Mi }
          startupProbe:
            httpGet: { path: /health/live, port: 8080, httpHeaders: [{ name: Host, value: orders-api }] }
            failureThreshold: 30
            periodSeconds: 2
          livenessProbe:
            httpGet: { path: /health/live, port: 8080, httpHeaders: [{ name: Host, value: orders-api }] }
            periodSeconds: 10
          readinessProbe:
            httpGet: { path: /health/ready, port: 8080, httpHeaders: [{ name: Host, value: orders-api }] }
            periodSeconds: 5
            timeoutSeconds: 3
          lifecycle:
            preStop:
              sleep: { seconds: 5 }
---
apiVersion: v1
kind: Service
metadata:
  name: orders-api
spec:
  selector: { app: orders-api }
  ports: [{ port: 80, targetPort: 8080 }]
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: orders-api
spec:
  minAvailable: 2
  selector:
    matchLabels: { app: orders-api }

name: orders-api
on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json
      - run: dotnet restore --locked-mode
      - run: dotnet build -c Release --no-restore -warnaserror
      - run: dotnet test -c Release --no-build
      - name: Build migration bundle
        run: |
          dotnet tool restore
          dotnet ef migrations bundle --project src/Orders.Api --runtime linux-x64 --self-contained -o efbundle --force
      - uses: actions/upload-artifact@v4
        with: { name: efbundle, path: efbundle }

  release:
    if: github.ref == 'refs/heads/main'
    needs: build
    runs-on: [self-hosted, linux, prod-network]
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json
      - uses: actions/download-artifact@v4
        with: { name: efbundle }
      - run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.example.com -u ci --password-stdin
      - run: >
          dotnet publish src/Orders.Api --os linux --arch x64 /t:PublishContainer
          -p:ContainerRegistry=registry.example.com -p:ContainerRepository=shop/orders-api
          -p:ContainerFamily=noble-chiseled -p:ContainerImageTags=${GITHUB_SHA::7}
      - run: chmod +x efbundle && ./efbundle --connection "${{ secrets.ORDERS_DB_MIGRATOR }}"
      - run: |
          kubectl set image deployment/orders-api api=registry.example.com/shop/orders-api:${GITHUB_SHA::7}
          kubectl rollout status deployment/orders-api --timeout=5m || (kubectl rollout undo deployment/orders-api && exit 1)