Add parachain image without tee-dev feature (#1567)

* add tee-prod image build

* add dependency

* small comment update

Author: Kailai-Wang

.github/workflows/ci.yml

@@ -20,12 +20,16 @@ name: General CI
 # jobs that will always be executed:
 # - fmt
 # - set-condition
-# - parachain-build
+# - parachain-build-dev
+# - parachain-build-tee-prod
 # - tee-build
 #
 # [4] please note that job-level if `env` is not supported:
 # https://github.com/actions/runner/issues/1189
 # as a workaround, we need to put it in a step-level or use `needs.outputs`
+#
+# [5] parachain-build-tee-prod builds the parachain image without `tee-dev` feature
+# It's used with tee-worker production deployment with HW mode.
 
 on:
   push:
@@ -240,7 +244,7 @@ jobs:
         if: failure()
         uses: andymckay/cancel-action@0.3
 
-  parachain-build:
+  parachain-build-dev:
     runs-on: ubuntu-latest
     needs:
       - fmt
@@ -263,13 +267,49 @@ jobs:
 
       - name: Save docker image
         run: |
-          docker save litentry/litentry-parachain -o litentry-parachain.tar
+          docker save litentry/litentry-parachain -o litentry-parachain-dev.tar
+
+      - name: Upload docker image
+        uses: actions/upload-artifact@v3
+        with:
+          name: parachain-artifact-dev
+          path: litentry-parachain-dev.tar
+          if-no-files-found: error
+
+      - name: Fail early
+        if: failure()
+        uses: andymckay/cancel-action@0.3
+
+  parachain-build-tee-prod:
+    runs-on: ubuntu-latest
+    needs:
+      - fmt
+      - set-condition
+      - sequentialise
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build docker image
+        if: needs.set-condition.outputs.rebuild_parachain == 'true'
+        run: |
+          ./scripts/build-docker.sh production tee-prod
+          echo "============================="
+          docker images
+
+      - name: Pull docker image optinally
+        if: needs.set-condition.outputs.rebuild_parachain == 'false'
+        run: |
+          docker pull litentry/litentry-parachain:tee-prod
+
+      - name: Save docker image
+        run: |
+          docker save litentry/litentry-parachain:tee-prod -o litentry-parachain-tee-prod.tar
 
       - name: Upload docker image
         uses: actions/upload-artifact@v3
         with:
-          name: parachain-artifact
-          path: litentry-parachain.tar
+          name: parachain-artifact-tee-prod
+          path: litentry-parachain-tee-prod.tar
           if-no-files-found: error
 
       - name: Fail early
@@ -350,7 +390,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - set-condition
-      - parachain-build
+      - parachain-build-dev
     strategy:
       matrix:
         chain:
@@ -362,11 +402,11 @@ jobs:
 
       - uses: actions/download-artifact@v3
         with:
-          name: parachain-artifact
+          name: parachain-artifact-dev
 
       - name: Load docker image
         run: |
-          docker load -i litentry-parachain.tar
+          docker load -i litentry-parachain-dev.tar
 
       - name: Run ts tests for ${{ matrix.chain }}
         if: needs.set-condition.outputs.run_parachain_test == 'true'
@@ -454,7 +494,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - set-condition
-      - parachain-build
+      - parachain-build-dev
       - tee-build
     env:
       WORKER_IMAGE_TAG: integritee-worker:dev
@@ -487,15 +527,15 @@ jobs:
 
       - uses: actions/download-artifact@v3
         with:
-          name: parachain-artifact
+          name: parachain-artifact-dev
 
       - uses: actions/download-artifact@v3
         with:
           name: tee-artifact
 
       - name: Load docker image
         run: |
-          docker load -i litentry-parachain.tar
+          docker load -i litentry-parachain-dev.tar
           docker load -i litentry-tee.tar
 
       - name: Re-name Image Tags
@@ -561,20 +601,26 @@ jobs:
     needs:
       - set-condition
       - parachain-ts-test
+      - parachain-build-tee-prod
       - tee-test
     if: ${{ !failure() && needs.set-condition.outputs.push_docker == 'true' }}
     steps:
       - uses: actions/download-artifact@v3
         with:
-          name: parachain-artifact
+          name: parachain-artifact-dev
+
+      - uses: actions/download-artifact@v3
+        with:
+          name: parachain-artifact-tee-prod
 
       - uses: actions/download-artifact@v3
         with:
           name: tee-artifact
 
       - name: Load docker image
         run: |
-          docker load -i litentry-parachain.tar
+          docker load -i litentry-parachain-dev.tar
+          docker load -i litentry-parachain-tee-prod.tar
           docker load -i litentry-tee.tar
 
       - name: Dockerhub login
@@ -583,13 +629,19 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      # only push the docker image if we rebuilt it
+      # only push `litentry/litentry-parachain` if we rebuilt it
       - name: Push parachain image
         if: needs.set-condition.outputs.rebuild_parachain == 'true'
         run: |
           docker push litentry/litentry-parachain
 
-      # only push the docker image if we rebuilt it
+      # only push `litentry/litentry-parachain:tee-prod` if we rebuilt it
+      - name: Push parachain image
+        if: needs.set-condition.outputs.rebuild_parachain == 'true'
+        run: |
+          docker push litentry/litentry-parachain:tee-prod
+
+      # only push TEE images if we rebuilt them
       - name: Push tee-worker image
         if: needs.set-condition.outputs.rebuild_tee == 'true'
         run: |