feat(opentrons-ai): add production deployment on tag (#15328)

## Production deploy using tags ai-server@ and ai-client@

AUTH-442

- [x] Add prod secrets
- [x] Add ruleset for these tags

.github/workflows/opentrons-ai-production-deploy.yaml

@@ -0,0 +1,105 @@
+name: 'OpentronsAI production deployment'
+
+on:
+  push:
+    tags:
+      - 'ai-client@*'
+      - 'ai-server@*'
+
+env:
+  CI: true
+
+jobs:
+  deploy-client:
+    if: startsWith(github.ref, 'refs/tags/ai-client@')
+    # if there is a deployment (this workflow) in progress for the ai-client@ tag, cancel it
+    concurrency:
+      group: ${{ github.workflow }}-ai-client@
+      cancel-in-progress: true
+    runs-on: 'ubuntu-22.04'
+    permissions:
+      id-token: write
+      contents: read
+    name: 'OpentronsAI client prod deploy'
+    timeout-minutes: 10
+    steps:
+      - uses: 'actions/checkout@v3'
+      - uses: 'actions/setup-node@v3'
+        with:
+          node-version: '18.19.0'
+      - name: 'install udev'
+        run: |
+          # WORKAROUND: Remove microsoft debian repo due to https://github.com/microsoft/linux-package-repositories/issues/130. Remove line below after it is resolved
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update && sudo apt-get install libudev-dev
+      - name: 'set complex environment variables'
+        id: 'set-vars'
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const { buildComplexEnvVars } = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/utils.js`)
+            buildComplexEnvVars(core, context)
+      - name: 'cache yarn cache'
+        uses: actions/cache@v3
+        with:
+          path: |
+            ${{ github.workspace }}/.npm-cache/_prebuild
+            ${{ github.workspace }}/.yarn-cache
+          key: js-${{ secrets.GH_CACHE_VERSION }}-${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
+      - name: 'setup-js'
+        run: |
+          npm config set cache ${{ github.workspace }}/.npm-cache
+          yarn config set cache-folder ${{ github.workspace }}/.yarn-cache
+          make setup-js
+      - name: 'build'
+        run: |
+          make -C opentrons-ai-client build
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PROD_AI_ROLE_ARN }}
+          aws-region: ${{ secrets.PROD_AI_REGION }}
+      - name: 'deploy client to prod'
+        run: |
+          make -C opentrons-ai-client prod-deploy
+
+  deploy-server:
+    if: startsWith(github.ref, 'refs/tags/ai-server@')
+    # if there is a deployment (this workflow) in progress for the ai-server@ tag, cancel it
+    concurrency:
+      group: ${{ github.workflow }}-ai-server@
+      cancel-in-progress: true
+    runs-on: 'ubuntu-latest'
+    permissions:
+      id-token: write
+      contents: read
+    name: 'OpentronsAI server prod deploy'
+    timeout-minutes: 10
+    steps:
+      - name: Extract Version
+        id: extract_version
+        run: |
+          TAG_REF=${{ github.ref }}
+          SERVER_VERSION=${TAG_REF#refs/tags/ai-server@}
+          echo "SERVER_VERSION=$SERVER_VERSION" >> "$GITHUB_OUTPUT"
+      - name: Checkout opentrons repo
+        uses: 'actions/checkout@v4'
+      - name: Setup Python
+        uses: 'actions/setup-python@v5'
+        with:
+          python-version: '3.12'
+          cache: 'pipenv'
+          cache-dependency-path: opentrons-ai-server/Pipfile.lock
+      - name: Setup
+        id: install
+        working-directory: ./opentrons-ai-server
+        run: make setup
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PROD_AI_ROLE_ARN }}
+          aws-region: ${{ secrets.PROD_AI_REGION }}
+      - name: 'deploy api to prod'
+        working-directory: ./opentrons-ai-server
+        run: |
+          make deploy ENV=prod TAG=${{ steps.extract_version.outputs.SERVER_VERSION }}

opentrons-ai-client/Makefile

@@ -65,3 +65,7 @@ test-cov:
 .PHONY: staging-deploy
 staging-deploy:
 	aws s3 sync ./dist s3://staging-opentrons-ai-front-end/ --delete
+
+.PHONY: prod-deploy
+prod-deploy:
+	aws s3 sync ./dist s3://prod-opentrons-ai-front-end/ --delete

opentrons-ai-server/Makefile

@@ -68,11 +68,12 @@ gen-requirements:
 	python -m pipenv requirements > requirements.txt
 
 ENV ?= local
+TAG ?=
 
 .PHONY: deploy
 deploy: gen-requirements
 	@echo "Deploying to environment: $(ENV)"
-	python -m pipenv run python deploy.py --env $(ENV)
+	python -m pipenv run python deploy.py --env $(ENV) $(if $(TAG),--tag $(TAG),)
 
 .PHONY: prompted-deploy
 prompted-deploy: gen-requirements