ci: separate core and cloud deployment (#3504)

.github/workflows/release.yml

@@ -19,7 +19,7 @@ on:
       - v*.*.*
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   dockerize-core:
@@ -135,9 +135,9 @@ jobs:
           build-args: |
             admin_endpoint=https://auth.logto.${{ inputs.target == 'prod' && 'io' || 'dev' }}/
 
-  deploy:
+  deploy-core:
     runs-on: ubuntu-latest
-    needs: [dockerize-core, dockerize-cloud]
+    needs: dockerize-core
     environment: ${{ inputs.target || 'dev' }}
     if: ${{ !startsWith(github.ref, 'refs/tags/') }}
 
@@ -159,13 +159,6 @@ jobs:
           pnpm cli db alt deploy next
         env:
           DB_URL: ${{ secrets.DB_URL }}
-      
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: silverhand-bot
-          password: ${{ secrets.BOT_PAT }}
 
       - name: Login via Azure CLI
         uses: azure/login@v1
@@ -179,6 +172,35 @@ jobs:
           slot-name: staging
           images: ghcr.io/logto-io/logto:sha-${{ steps.sha.outputs.short }}
 
+      - name: Swap core to production
+        # See https://learn.microsoft.com/en-us/cli/azure/webapp/deployment/slot?view=azure-cli-latest#az-webapp-deployment-slot-swap
+        run: az webapp deployment slot swap -g ${{ vars.RESOURCE_GROUP }} -n ${{ vars.APP_NAME_CORE }} --slot staging
+
+  deploy-cloud:
+    runs-on: ubuntu-latest
+    needs: dockerize-cloud
+    environment: ${{ inputs.target || 'dev' }}
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set short sha
+        id: sha
+        run: echo "short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+      
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: silverhand-bot
+          password: ${{ secrets.BOT_PAT }}
+
+      - name: Login via Azure CLI
+        uses: azure/login@v1
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
       - name: Deploy cloud to containerapp
         uses: azure/webapps-deploy@v2
         with:
@@ -186,10 +208,6 @@ jobs:
           slot-name: staging
           images: ghcr.io/logto-io/cloud:sha-${{ steps.sha.outputs.short }}
 
-      - name: Swap core to production
-        # See https://learn.microsoft.com/en-us/cli/azure/webapp/deployment/slot?view=azure-cli-latest#az-webapp-deployment-slot-swap
-        run: az webapp deployment slot swap -g ${{ vars.RESOURCE_GROUP }} -n ${{ vars.APP_NAME_CORE }} --slot staging
-
       - name: Swap cloud to production
         # See https://learn.microsoft.com/en-us/cli/azure/webapp/deployment/slot?view=azure-cli-latest#az-webapp-deployment-slot-swap
         run: az webapp deployment slot swap -g ${{ vars.RESOURCE_GROUP }} -n ${{ vars.APP_NAME_CLOUD }} --slot staging