feat: own production deployment manifests

.github/workflows/publish-images.yml

@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - deploy/prod/**
 
 permissions:
-  contents: read
+  contents: write
   packages: write
 
 env:
@@ -46,3 +48,33 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service }}:${{ github.sha }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service }}:main
+
+  update-deploy:
+    name: Update production image tags
+    runs-on: ubuntu-latest
+    needs: publish
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update deploy/prod image tags
+        run: |
+          set -euo pipefail
+          sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/site-analyzer/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
+          sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/scraper/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
+
+      - name: Commit production image tag update
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- deploy/prod/kustomization.yaml; then
+            echo "deploy/prod image tags already match ${GITHUB_SHA}"
+            exit 0
+          fi
+
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git add deploy/prod/kustomization.yaml
+          git commit -m "chore: update production image tags [skip ci]"
+          git push