Add RiffRaff deploy step for repository. Fix tags

.github/workflows/build-whisper-docker.yml

@@ -12,8 +12,9 @@ on:
 
 # Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
 env:
-  REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  BUILD_NUMBER: ${{ github.run_number }}
+  GITHUB_REGISTRY: ghcr.io
 
 # There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
 jobs:
@@ -35,16 +36,17 @@ jobs:
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
+          registry: ${{ env.GITHUB_REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      # Note - this step is the thing where we are indicating which repositories we want to push the container to
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}
             ${{ secrets.TRANSCRIPTION_SERVICE_ECR_URI }}
           tags: |
             type=sha

.github/workflows/ci.yaml

@@ -51,5 +51,13 @@ jobs:
               - packages/cdk/cdk.out/TranscriptionService-PROD.template.json
             transcription-service:
               - packages/api/target/api.zip
-            transcription-service-worker:
               - packages/worker/target/worker.zip
+      - name: Upload repository project to riff-raff
+        uses: guardian/actions-riff-raff@v3
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          configPath: packages/cdk/riff-raff-repository.yaml
+          projectName: investigations::transcription-service-repository
+          contentDirectories: |
+            cdk.out:
+              - packages/cdk/cdk.out/TranscriptionServiceRepository.template.json

packages/cdk/lib/repository.ts

@@ -37,7 +37,7 @@ export class TranscriptionServiceRepository extends GuStack {
 					maxImageCount: 5,
 				},
 			],
-			imageTagMutability: TagMutability.IMMUTABLE,
+			imageTagMutability: TagMutability.MUTABLE,
 			removalPolicy: RemovalPolicy.DESTROY,
 			imageScanOnPush: true,
 		});

packages/cdk/riff-raff-repository.yaml

@@ -0,0 +1,14 @@
+allowedStages:
+  - PROD
+deployments:
+  cfn-eu-west-1-investigations-transcription-service-repository:
+    type: cloud-formation
+    regions:
+      - eu-west-1
+    stacks:
+      - investigations
+    app: transcription-service-repository
+    contentDirectory: cdk.out
+    parameters:
+      templateStagePaths:
+        PROD: TranscriptionServiceRepository.template.json