Prepare for release of the institutional website

.deployment-envs/.env.production

@@ -1,3 +1,4 @@
+NEXT_PUBLIC_ACCOUNTING_BASE_URL=https://www.openbraininstitute.org/api/accounting
 NEXT_PUBLIC_NEXUS_URL=https://openbluebrain.com/api/nexus/v1
 NEXT_PUBLIC_BLUE_NAAS_URL=https://www.openbraininstitute.org/api/bluenaas
 NEXT_PUBLIC_CELL_SVC_BASE_URL=https://www.openbraininstitute.org/api/circuit

.deployment-envs/.env.staging

@@ -1,3 +1,4 @@
+NEXT_PUBLIC_ACCOUNTING_BASE_URL=https://staging.openbraininstitute.org/api/accounting
 NEXT_PUBLIC_NEXUS_URL=https://staging.openbraininstitute.org/api/nexus/v1
 NEXT_PUBLIC_BLUE_NAAS_URL=https://staging.openbraininstitute.org/api/bluenaas
 NEXT_PUBLIC_CELL_SVC_BASE_URL=https://staging.openbraininstitute.org/api/circuit

.github/workflows/publish-production-image.yml

@@ -13,6 +13,12 @@ jobs:
       ENVIRONMENT: staging
       IMAGE_NAME: ${{ vars.PUBLICECR_URI }}
     steps:
+      - name: Fail if branch is not main
+        if: github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/main'
+        run: |
+          echo "This workflow should not be triggered with workflow_dispatch on a branch other than main"
+          exit 1
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:

.github/workflows/publish-staging-image.yml

@@ -1,13 +1,21 @@
-name: Publish STAGING image
+name: Deploy to STAGING
+
+permissions:
+  id-token: write # Required for OIDC authentication
+  contents: read # Standard permission for GitHub Actions
 
 on:
   push:
     branches:
       - develop
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  publish-image:
+  deploy-staging:
     runs-on: ubuntu-latest
     env:
       ENVIRONMENT: staging
@@ -23,7 +31,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.PUBLICECR_UPLOAD_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.PUBLICECR_REGION }}
 
-      - name: Authenticate with AWS Public ECR
+      - name: Authenticate with AWS ECR
         uses: aws-actions/amazon-ecr-login@v2
         with:
           registry-type: public
@@ -35,3 +43,22 @@ jobs:
       - name: Publish To AWS ECR
         run: |
           docker push ${{ vars.PUBLICECR_URI }}:staging
+
+      - name: Authenticate with AWS ECS
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_STAGING_ECS_REDEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_STAGING_REGION }}
+
+      - name: Trigger new deployment
+        run: |
+          aws ecs update-service \
+            --cluster ${{ vars.AWS_STAGING_ECS_CLUSTER }} \
+            --service ${{ vars.AWS_STAGING_ECS_SERVICE }} \
+            --force-new-deployment
+
+      - name: Wait until the service is stable
+        run: |
+          aws ecs wait services-stable \
+            --cluster ${{ vars.AWS_STAGING_ECS_CLUSTER }} \
+            --service ${{ vars.AWS_STAGING_ECS_SERVICE }}

.gitignore

@@ -205,3 +205,4 @@ certificates
 notes.md
 
 .VSCodeCounter
+*~