From e2520be6680f841c89baa1c3cf8078ddfa207940 Mon Sep 17 00:00:00 2001
From: Han Ngo <nntruonghan@gmail.com>
Date: Sun, 19 Jul 2026 08:37:43 +0700
Subject: [PATCH 1/2] fix(ci): migrate preview deploy off deleted GCP SA to ECR

---
 .github/workflows/gke-dev.yml | 37 +++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/gke-dev.yml b/.github/workflows/gke-dev.yml
index 1a653803a..6e83d9516 100755
--- a/.github/workflows/gke-dev.yml
+++ b/.github/workflows/gke-dev.yml
@@ -1,4 +1,4 @@
-name: Build and Deploy to GKE Preview
+name: Build and Deploy to Preview (ECR)
 
 on:
   push:
@@ -7,10 +7,16 @@ on:
 
 # Environment variables available to all jobs and steps in this workflow
 env:
+  # AWS ECR, mirroring gke-prod.yml's migration off the deleted GCP service
+  # account (see that file's header note). Same registry, preview overlay.
   GITHUB_SHA: ${{ github.sha }}
-  REGISTRY_HOSTNAME: gcr.io
-  GKE_PROJECT: console-labs-prod
-  IMAGE: consolelabs/mochi-api
+  AWS_REGION: ap-southeast-1
+  ECR_REGISTRY: 768727713577.dkr.ecr.ap-southeast-1.amazonaws.com
+  IMAGE: mochi/api
+  # The kustomize overlays still key their images: transform on the legacy
+  # GAR name referenced by deployment.yaml, so `kustomize edit set image`
+  # must use it as the old name or the edit is a no-op.
+  LEGACY_IMAGE_NAME: asia-southeast1-docker.pkg.dev/console-labs-prod/consolelabs/mochi-api
   K8S_ENVIRONMENT: preview
 
 jobs:
@@ -21,24 +27,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - id: "auth"
-        name: "Authenticate to Google Cloud"
-        uses: "google-github-actions/auth@v0"
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          credentials_json: "${{ secrets.GCP_CREDENTIALS }}"
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
 
-      - name: "Set up Cloud SDK"
-        uses: "google-github-actions/setup-gcloud@v0"
-
-      - name: Setup Docker
-        run: |
-          gcloud auth configure-docker gcr.io
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
 
       # Build & Push the Docker image
       - name: Build & Push
         run: |
-          docker build -t $REGISTRY_HOSTNAME/$GKE_PROJECT/$IMAGE:${GITHUB_SHA} .   
-          docker push $REGISTRY_HOSTNAME/$GKE_PROJECT/$IMAGE:${GITHUB_SHA}
+          docker build -t $ECR_REGISTRY/$IMAGE:${GITHUB_SHA} .
+          docker push $ECR_REGISTRY/$IMAGE:${GITHUB_SHA}
       # Setup kustomize
       - name: Setup kustomize
         run: |
@@ -57,6 +60,6 @@ jobs:
           cd ./infrastructure/mochi-api/$K8S_ENVIRONMENT
           git config user.name jphuc96
           git config user.email jphuc96@gmail.com
-          /tmp/kustomize edit set image $REGISTRY_HOSTNAME/$GKE_PROJECT/$IMAGE=$REGISTRY_HOSTNAME/$GKE_PROJECT/$IMAGE:${GITHUB_SHA}
+          /tmp/kustomize edit set image $LEGACY_IMAGE_NAME=$ECR_REGISTRY/$IMAGE:${GITHUB_SHA}
           git commit -am "[skip ci] mochi-api ${K8S_ENVIRONMENT} image update"
           git push origin main

From 18783cfd0fbcfa9cd4f94bf809782d9aca46e9ef Mon Sep 17 00:00:00 2001
From: Han Ngo <nntruonghan@gmail.com>
Date: Sun, 19 Jul 2026 08:37:43 +0700
Subject: [PATCH 2/2] fix(ci): key prod kustomize image edit on the legacy GAR
 name

---
 .github/workflows/gke-prod.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/gke-prod.yml b/.github/workflows/gke-prod.yml
index e1dd348e7..89ab8fad5 100755
--- a/.github/workflows/gke-prod.yml
+++ b/.github/workflows/gke-prod.yml
@@ -13,6 +13,10 @@ env:
   AWS_REGION: ap-southeast-1
   ECR_REGISTRY: 768727713577.dkr.ecr.ap-southeast-1.amazonaws.com
   IMAGE: mochi/api
+  # The kustomize overlays still key their images: transform on the legacy
+  # GAR name referenced by deployment.yaml, so `kustomize edit set image`
+  # must use it as the old name or the edit is a no-op.
+  LEGACY_IMAGE_NAME: asia-southeast1-docker.pkg.dev/console-labs-prod/consolelabs/mochi-api
   K8S_ENVIRONMENT: prod
 
 jobs:
@@ -56,7 +60,7 @@ jobs:
           cd ./infrastructure/mochi-api/$K8S_ENVIRONMENT
           git config user.name jphuc96
           git config user.email jphuc96@gmail.com
-          /tmp/kustomize edit set image $ECR_REGISTRY/$IMAGE=$ECR_REGISTRY/$IMAGE:${GITHUB_REF_NAME}
+          /tmp/kustomize edit set image $LEGACY_IMAGE_NAME=$ECR_REGISTRY/$IMAGE:${GITHUB_REF_NAME}
           git commit -am "[skip ci] mochi-api ${K8S_ENVIRONMENT} image update"
           git push origin main