ci: build the desktop template on every cluster (foxtrot, juliett, tango)

.github/workflows/template.yml

@@ -7,17 +7,20 @@
       - '.github/workflows/template.yml'
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  buildAndPublish:
+  # The DockerHub image is cluster-independent, so it is only rebuilt on pushes.
+  buildAndPushImage:
+    if: ${{ github.event_name == 'push' }}
     defaults:
       run:
         working-directory: ./template
 
-    name: Build and Push Images
+    name: Build and Push Image to DockerHub
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
@@ -64,7 +67,71 @@
             --push \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/desktop:latest -f - files
 
+  # The template is built on every production cluster. Clusters are separate
+  # tenancies with separate template registries, so each needs its own build.
+  buildTemplate:
+    name: Build E2B template (${{ matrix.cluster }})
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - cluster: foxtrot
+            domain: e2b.dev
+            api_key_secret: E2B_API_KEY
+          - cluster: juliett
+            domain: e2b-juliett.dev
+            api_key_secret: E2B_JULIETT_API_KEY
+          - cluster: tango
+            domain: e2b-tango.dev
+            api_key_secret: E2B_TANGO_API_KEY
+    # Builds on the same cluster serialize; different clusters run concurrently.
+    concurrency:
+      group: Template-${{ github.ref }}-${{ matrix.cluster }}
+      cancel-in-progress: false
+    defaults:
+      run:
+        working-directory: ./template
+    env:
+      E2B_API_KEY: ${{ secrets[matrix.api_key_secret] }}
+      E2B_DOMAIN: ${{ matrix.domain }}
+    steps:
+      - name: Check the cluster API key
+        env:
+          CLUSTER: ${{ matrix.cluster }}
+          API_KEY_SECRET: ${{ matrix.api_key_secret }}
+        run: |
+          if [ -z "$E2B_API_KEY" ]; then
+            echo "::error::Missing secret $API_KEY_SECRET for cluster: $CLUSTER" >&2
+            exit 1
+          fi
+
+      - name: Checkout repository
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+
+      - name: Parse .tool-versions
+        uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1
+        id: tool-versions
+        with:
+          filename: '.tool-versions'
+          uppercase: 'true'
+          prefix: 'tool_version_'
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '${{ env.TOOL_VERSION_PYTHON }}'
+
+      - name: Install and configure Poetry
+        uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
+        with:
+          version: ${{ env.TOOL_VERSION_POETRY }}
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+          installer-parallel: true
+
+      - name: Install dependencies
+        run: poetry install
+
       - name: Build E2B template
         run: poetry run python build_prod.py
-        env:
-          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}