From de59eda1717892ebbe8264226efed0c8a0c30ca4 Mon Sep 17 00:00:00 2001
From: Katsuhiro Yamanaka <29446925+ogis-yamanaka@users.noreply.github.com>
Date: Fri, 14 Jun 2024 09:22:53 +0900
Subject: [PATCH] =?UTF-8?q?=E3=83=95=E3=82=A1=E3=82=A4=E3=83=AB=E5=88=86?=
 =?UTF-8?q?=E5=89=B2=E3=83=86=E3=82=B9=E3=83=88?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/aws.yml           |  52 ++++++
 .github/workflows/azure.yml         | 102 ++++++++++++
 .github/workflows/build-payment.yml | 247 +++++++++++++---------------
 3 files changed, 267 insertions(+), 134 deletions(-)
 create mode 100644 .github/workflows/aws.yml
 create mode 100644 .github/workflows/azure.yml

diff --git a/.github/workflows/aws.yml b/.github/workflows/aws.yml
new file mode 100644
index 0000000..f49a2b8
--- /dev/null
+++ b/.github/workflows/aws.yml
@@ -0,0 +1,52 @@
+name: Go CI Payment and Credit Application
+
+on:
+  workflow_call:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    environment: develop # for azure oidc
+
+    env:
+      IMAGE_TAG: ${{ github.sha }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Checkout manifest repo
+        uses: actions/checkout@v3
+        with:
+          repository: nautible/nautible-app-ms-payment-manifest
+          path: nautible-app-ms-payment-manifest
+          token: ${{ secrets.PAT }}
+
+      # AWS
+      - name: PaymentApp Build, tag, and push image to Amazon ECR
+        id: build-payment-image-service-ecr
+        env:
+          DOCKER_BUILDKIT: 1
+          ECR_REGISTRY: public.ecr.aws/nautible
+          ECR_REPOSITORY: nautible-app-ms-payment
+        run: |
+          cd $GITHUB_WORKSPACE
+          docker build --cache-from=$ECR_REGISTRY/$ECR_REPOSITORY:latest --build-arg CLOUD=aws --build-arg BUILDKIT_INLINE_CACHE=1 -t $ECR_REGISTRY/$ECR_REPOSITORY:latest -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f ./package/payment/Dockerfile .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+      - name: CreditApp Build, tag, and push image to Amazon ECR
+        id: build-credit-image-service-ecr
+        env:
+          DOCKER_BUILDKIT: 1
+          ECR_REGISTRY: public.ecr.aws/nautible
+          ECR_REPOSITORY: nautible-app-ms-payment-credit
+        run: |
+          cd $GITHUB_WORKSPACE
+          docker build --cache-from=$ECR_REGISTRY/$ECR_REPOSITORY:latest --build-arg CLOUD=aws --build-arg BUILDKIT_INLINE_CACHE=1 -t $ECR_REGISTRY/$ECR_REPOSITORY:latest -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f ./package/credit/Dockerfile .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
diff --git a/.github/workflows/azure.yml b/.github/workflows/azure.yml
new file mode 100644
index 0000000..2d88f06
--- /dev/null
+++ b/.github/workflows/azure.yml
@@ -0,0 +1,102 @@
+name: Go CI Payment and Credit Application
+
+on:
+  workflow_call:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    environment: develop # for azure oidc
+
+    env:
+      IMAGE_TAG: ${{ github.sha }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Checkout manifest repo
+        uses: actions/checkout@v3
+        with:
+          repository: nautible/nautible-app-ms-payment-manifest
+          path: nautible-app-ms-payment-manifest
+          token: ${{ secrets.PAT }}
+
+      # Azure
+      - name: PaymentApp Build, tag, and push image to Azure ACR
+        id: build-payment-image-service-acr
+        env:
+          DOCKER_BUILDKIT: 1
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+          ACR_REPOSITORY: nautible-app-ms-payment
+        run: |
+          cd $GITHUB_WORKSPACE
+          docker build --cache-from=$ACR_REGISTRY/$ACR_REPOSITORY:latest --build-arg CLOUD=azure --build-arg BUILDKIT_INLINE_CACHE=1 -t $ACR_REGISTRY/$ACR_REPOSITORY:latest -t $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG -f ./package/payment/Dockerfile .
+          docker push $ACR_REGISTRY/$ACR_REPOSITORY:latest
+          docker push $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG
+
+      - name: CreditApp Build, tag, and push image to Azure ACR
+        id: build-credit-image-service-acr
+        env:
+          DOCKER_BUILDKIT: 1
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+          ACR_REPOSITORY: nautible-app-ms-credit
+        run: |
+          cd $GITHUB_WORKSPACE
+          docker build --cache-from=$ACR_REGISTRY/$ACR_REPOSITORY:latest --build-arg CLOUD=azure --build-arg BUILDKIT_INLINE_CACHE=1 -t $ACR_REGISTRY/$ACR_REPOSITORY:latest -t $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG -f ./package/credit/Dockerfile .
+          docker push $ACR_REGISTRY/$ACR_REPOSITORY:latest
+          docker push $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG
+
+      - name: update feature branch image tag
+        id: update-feature-branch-image-tag
+        if: startsWith(github.ref_name, 'feature/')
+        env:
+          TOKEN: ${{ secrets.PAT }}
+          BRANCH: ${{ github.ref_name }}
+          APP_NAME: payment
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+        run: |
+          cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
+          HTTP_STATUS=$(curl -H "Accept: application/vnd.github+json" -H "Authorization: token $TOKEN" https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/branches/$BRANCH -o /dev/null -w '%{http_code}\n' -s)
+          if [ "$HTTP_STATUS" != '200' ]; then
+            echo 'couldnt find remote branch. skip update manifest.'
+            exit 0
+          fi
+          git fetch origin $BRANCH && git checkout $BRANCH
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git add .
+          git commit -m "update manifest"
+          git push
+
+      - name: pull request
+        id: pull-request
+        if: github.ref_name == 'develop' || startsWith(github.ref_name, 'hotfix/')
+        env:
+          TOKEN: ${{ secrets.PAT }}
+          BRANCH: ${{ github.ref_name }}
+          TAG: update-image-feature-${{ github.sha }}
+          APP_NAME: payment
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+        run: |
+          cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
+          git fetch origin $BRANCH && git checkout $BRANCH
+          git checkout -b $TAG $BRANCH
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git add .
+          git commit -m "update manifest"
+          git push --set-upstream origin $TAG
+          curl -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $TOKEN" "https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/pulls" -d '{"title": "new image deploy request", "head": "nautible:'$TAG'", "base": "'$BRANCH'"}' -o /dev/null -w 'httpstatus:%{http_code}\n' -s
diff --git a/.github/workflows/build-payment.yml b/.github/workflows/build-payment.yml
index 1f3cf44..e1cd91c 100644
--- a/.github/workflows/build-payment.yml
+++ b/.github/workflows/build-payment.yml
@@ -2,8 +2,8 @@ name: Go CI Payment and Credit Application
 
 on:
   push:
-    branches: [ "develop","feature/*","hotfix/*" ]
-    paths: 
+    branches: ['develop', 'feature/*', 'hotfix/*']
+    paths:
       - 'cmd/**'
       - 'pkg/**'
       - 'package/**'
@@ -16,7 +16,6 @@ permissions:
 
 jobs:
   build:
-    
     runs-on: ubuntu-latest
 
     environment: develop # for azure oidc
@@ -25,134 +24,114 @@ jobs:
       IMAGE_TAG: ${{ github.sha }}
 
     steps:
-    - name: Checkout repo
-      uses: actions/checkout@v3
-    - name: Checkout manifest repo
-      uses: actions/checkout@v3
-      with:
-        repository: nautible/nautible-app-ms-payment-manifest
-        path: nautible-app-ms-payment-manifest
-        token: ${{ secrets.PAT }}
-  
-    # AWS
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v1
-      with:
-        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nautible-dev-githubactions-ecr-access-role
-        aws-region: ap-northeast-1
-    - name: Login to Amazon public ECR
-      id: login-ecr
-      run: |
-        aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/nautible
-
-    - name: PaymentApp Build, tag, and push image to Amazon ECR
-      id: build-payment-image-service-ecr
-      env:
-        DOCKER_BUILDKIT: 1
-        ECR_REGISTRY: public.ecr.aws/nautible
-        ECR_REPOSITORY: nautible-app-ms-payment
-      run: |
-        cd $GITHUB_WORKSPACE
-        docker build --cache-from=$ECR_REGISTRY/$ECR_REPOSITORY:latest --build-arg CLOUD=aws --build-arg BUILDKIT_INLINE_CACHE=1 -t $ECR_REGISTRY/$ECR_REPOSITORY:latest -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f ./package/payment/Dockerfile .
-        docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
-        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-
-    - name: CreditApp Build, tag, and push image to Amazon ECR
-      id: build-credit-image-service-ecr
-      env:
-        DOCKER_BUILDKIT: 1
-        ECR_REGISTRY: public.ecr.aws/nautible
-        ECR_REPOSITORY: nautible-app-ms-payment-credit
-      run: |
-        cd $GITHUB_WORKSPACE
-        docker build --cache-from=$ECR_REGISTRY/$ECR_REPOSITORY:latest --build-arg CLOUD=aws --build-arg BUILDKIT_INLINE_CACHE=1 -t $ECR_REGISTRY/$ECR_REPOSITORY:latest -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f ./package/credit/Dockerfile .
-        docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
-        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-
-    # Azure
-    - name: Login via Azure CLI
-      id: login-acr
-      uses: azure/login@v1
-      with:
-        client-id: ${{ secrets.AZURE_CLIENT_ID }}
-        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-    - name: Login Azure Acr
-      id: login-azure-acr
-      run: |
-        az acr login -n nautibledevacr
-
-    - name: PaymentApp Build, tag, and push image to Azure ACR
-      id: build-payment-image-service-acr
-      env:
-        DOCKER_BUILDKIT: 1
-        ACR_REGISTRY: nautibledevacr.azurecr.io
-        ACR_REPOSITORY: nautible-app-ms-payment
-      run: |
-        cd $GITHUB_WORKSPACE
-        docker build --cache-from=$ACR_REGISTRY/$ACR_REPOSITORY:latest --build-arg CLOUD=azure --build-arg BUILDKIT_INLINE_CACHE=1 -t $ACR_REGISTRY/$ACR_REPOSITORY:latest -t $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG -f ./package/payment/Dockerfile .
-        docker push $ACR_REGISTRY/$ACR_REPOSITORY:latest
-        docker push $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG
-
-    - name: CreditApp Build, tag, and push image to Azure ACR
-      id: build-credit-image-service-acr
-      env:
-        DOCKER_BUILDKIT: 1
-        ACR_REGISTRY: nautibledevacr.azurecr.io
-        ACR_REPOSITORY: nautible-app-ms-credit
-      run: |
-        cd $GITHUB_WORKSPACE
-        docker build --cache-from=$ACR_REGISTRY/$ACR_REPOSITORY:latest --build-arg CLOUD=azure --build-arg BUILDKIT_INLINE_CACHE=1 -t $ACR_REGISTRY/$ACR_REPOSITORY:latest -t $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG -f ./package/credit/Dockerfile .
-        docker push $ACR_REGISTRY/$ACR_REPOSITORY:latest
-        docker push $ACR_REGISTRY/$ACR_REPOSITORY:$IMAGE_TAG
-
-    - name: update feature branch image tag
-      id: update-feature-branch-image-tag
-      if: startsWith(github.ref_name, 'feature/')
-      env:
-        TOKEN: ${{ secrets.PAT }}
-        BRANCH: ${{ github.ref_name }}
-        APP_NAME: payment
-        ACR_REGISTRY: nautibledevacr.azurecr.io
-      run: |
-        cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
-        HTTP_STATUS=$(curl -H "Accept: application/vnd.github+json" -H "Authorization: token $TOKEN" https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/branches/$BRANCH -o /dev/null -w '%{http_code}\n' -s)
-        if [ "$HTTP_STATUS" != '200' ]; then
-          echo 'couldnt find remote branch. skip update manifest.'
-          exit 0
-        fi
-        git fetch origin $BRANCH && git checkout $BRANCH
-        sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
-        sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
-        sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
-        sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
-        git config user.name github-actions[bot]
-        git config user.email github-actions[bot]@users.noreply.github.com
-        git add .
-        git commit -m "update manifest"
-        git push
-
-    - name: pull request
-      id: pull-request
-      if: github.ref_name == 'develop' || startsWith(github.ref_name, 'hotfix/')
-      env:
-        TOKEN: ${{ secrets.PAT }}
-        BRANCH: ${{ github.ref_name }}
-        TAG: update-image-feature-${{ github.sha }}
-        APP_NAME: payment
-        ACR_REGISTRY: nautibledevacr.azurecr.io
-      run: |
-        cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
-        git fetch origin $BRANCH && git checkout $BRANCH
-        git checkout -b $TAG $BRANCH
-        sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
-        sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
-        sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
-        sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
-        git config user.name github-actions[bot]
-        git config user.email github-actions[bot]@users.noreply.github.com
-        git add .
-        git commit -m "update manifest"
-        git push --set-upstream origin $TAG
-        curl -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $TOKEN" "https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/pulls" -d '{"title": "new image deploy request", "head": "nautible:'$TAG'", "base": "'$BRANCH'"}' -o /dev/null -w 'httpstatus:%{http_code}\n' -s
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Checkout manifest repo
+        uses: actions/checkout@v3
+        with:
+          repository: nautible/nautible-app-ms-payment-manifest
+          path: nautible-app-ms-payment-manifest
+          token: ${{ secrets.PAT }}
+
+      # AWS
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nautible-dev-githubactions-ecr-access-role
+          aws-region: ap-northeast-1
+      - name: Login to Amazon public ECR
+        id: login-ecr
+        run: |
+          aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/nautible
+        continue-on-error: true
+      - name: output step context_aws
+        run: echo $CONTEXT
+        env:
+          CONTEXT: ${{ toJSON(steps.login-ecr) }}
+
+      - name: login-ecr when command success
+        uses: ./.github/workflows/aws.yml
+        if: steps.login-ecr.outcome == 'success'
+
+      - name: login-ecr when command failure
+        run: echo "result - aws ecr login failure"
+        if: steps.login-ecr.outcome == 'failure'
+
+        # Azure
+      - name: Login via Azure CLI
+        id: login-acr
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Login Azure Acr
+        id: login-azure-acr
+        run: |
+          az acr login -n nautibledevacr
+        continue-on-error: true
+
+      - name: output step context_azure
+        run: echo $CONTEXT
+        env:
+          CONTEXT: ${{ toJSON(steps.login-azure-acr) }}
+
+      - name: login-azure-acr when command success
+        uses: ./.github/workflows/azure.yml
+        if: steps.login-azure-acr.outcome == 'success'
+
+      - name: login-azure-acr when command failure
+        run: echo "result - azure acr login failure"
+        if: steps.login-azure-acr.outcome == 'failure'
+
+      # pullrequest
+      - name: update feature branch image tag
+        id: update-feature-branch-image-tag
+        if: startsWith(github.ref_name, 'feature/')
+        env:
+          TOKEN: ${{ secrets.PAT }}
+          BRANCH: ${{ github.ref_name }}
+          APP_NAME: payment
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+        run: |
+          cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
+          HTTP_STATUS=$(curl -H "Accept: application/vnd.github+json" -H "Authorization: token $TOKEN" https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/branches/$BRANCH -o /dev/null -w '%{http_code}\n' -s)
+          if [ "$HTTP_STATUS" != '200' ]; then
+            echo 'couldnt find remote branch. skip update manifest.'
+            exit 0
+          fi
+          git fetch origin $BRANCH && git checkout $BRANCH
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git add .
+          git commit -m "update manifest"
+          git push
+
+      - name: pull request
+        id: pull-request
+        if: github.ref_name == 'develop' || startsWith(github.ref_name, 'hotfix/')
+        env:
+          TOKEN: ${{ secrets.PAT }}
+          BRANCH: ${{ github.ref_name }}
+          TAG: update-image-feature-${{ github.sha }}
+          APP_NAME: payment
+          ACR_REGISTRY: nautibledevacr.azurecr.io
+        run: |
+          cd $GITHUB_WORKSPACE/nautible-app-ms-$APP_NAME-manifest
+          git fetch origin $BRANCH && git checkout $BRANCH
+          git checkout -b $TAG $BRANCH
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./base/$APP_NAME-deploy.yaml 
+          sed -i 's/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:\(.*\)/image: public.ecr.aws\/nautible\/nautible-app-ms-'$APP_NAME'-credit:'$IMAGE_TAG'/' ./base/$APP_NAME-credit-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-'$APP_NAME':'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-deploy.yaml 
+          sed -i 's/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:\(.*\)/image: ${{ secrets.AZURE_REGISTRY_LOGIN_SERVER }}\/nautible-app-ms-credit:'$IMAGE_TAG'/' ./overlays/azure/dev/$APP_NAME-credit-deploy.yaml 
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git add .
+          git commit -m "update manifest"
+          git push --set-upstream origin $TAG
+          curl -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $TOKEN" "https://api.github.com/repos/nautible/nautible-app-ms-$APP_NAME-manifest/pulls" -d '{"title": "new image deploy request", "head": "nautible:'$TAG'", "base": "'$BRANCH'"}' -o /dev/null -w 'httpstatus:%{http_code}\n' -s