Skip to content

Commit 7d1908d

Browse files
anthony-nhsanthony-nhs
committed
changes following feedback
1 parent bb609cd commit 7d1908d

File tree

4 files changed

+110
-115
lines changed

4 files changed

+110
-115
lines changed

‎.github/workflows/build_nhsd_git_secrets.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@ on:
1616
type: string
1717
description: "The tag to use for the dev container image."
1818
required: true
19-
check_ecr_image_scan_results_script_tag:
20-
type: string
21-
description: "The tag to download check_ecr_image_scan_results.sh script."
22-
required: false
23-
default: "dev_container_build"
2419
jobs:
2520
build_nhsd_git_secrets_x64:
2621
permissions:

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -73,20 +73,20 @@ jobs:
7373
secrets: inherit
7474
tag_latest_dev_container:
7575
needs: [quality_checks, get_commit_id, tag_release]
76-
uses: ./.github/workflows/tag_latest_dev_container.yml
76+
uses: ./.github/workflows/tag_latest_container_images.yml
7777
with:
78-
dev_container_ecr: dev-container-quality-checks
79-
dev_container_image_tag: release-${{ needs.get_commit_id.outputs.sha_short }}
78+
ecr_name: dev-container-quality-checks
79+
container_image_tag: release-${{ needs.get_commit_id.outputs.sha_short }}
8080
version_tag_to_apply: ${{ needs.tag_release.outputs.version_tag }}
8181
secrets:
8282
PUSH_IMAGE_ROLE: ${{ secrets.DEV_CONTAINER_PUSH_IMAGE_ROLE }}
8383

8484
tag_latest_nhsd_git_secrets:
8585
needs: [quality_checks, get_commit_id, tag_release]
86-
uses: ./.github/workflows/tag_latest_dev_container.yml
86+
uses: ./.github/workflows/tag_latest_container_images.yml
8787
with:
88-
dev_container_ecr: dev-container-git-secrets
89-
dev_container_image_tag: release-${{ needs.get_commit_id.outputs.sha_short }}
88+
ecr_name: git-secrets
89+
container_image_tag: release-${{ needs.get_commit_id.outputs.sha_short }}
9090
version_tag_to_apply: ${{ needs.tag_release.outputs.version_tag }}
9191
secrets:
9292
PUSH_IMAGE_ROLE: ${{ secrets.DEV_CONTAINER_PUSH_IMAGE_ROLE }}

‎.github/workflows/tag_latest_container_images.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Tag Latest container images
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
PUSH_IMAGE_ROLE:
7+
required: true
8+
inputs:
9+
ecr_name:
10+
type: string
11+
description: "The name of the ECR repository to push the dev container image to."
12+
required: true
13+
container_image_tag:
14+
type: string
15+
description: "The tag to use for the dev container image."
16+
required: true
17+
version_tag_to_apply:
18+
type: string
19+
description: "The version tag to apply to the latest dev container image."
20+
required: true
21+
jobs:
22+
tag_latest_container_images:
23+
permissions:
24+
id-token: write
25+
runs-on: ubuntu-22.04
26+
steps:
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
29+
30+
- name: Configure AWS Credentials
31+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
32+
with:
33+
aws-region: eu-west-2
34+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
35+
role-session-name: multi-arch-manifest
36+
output-credentials: true
37+
38+
- name: Retrieve AWS Account ID
39+
id: retrieve-deploy-account-id
40+
run: |
41+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
42+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
43+
44+
- name: Login to Amazon ECR
45+
run: |
46+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
47+
48+
- name: Create and push multi-architecture manifest for tag
49+
env:
50+
ECR_REPOSITORY: ${{ inputs.ecr_name }}
51+
IMAGE_TAG: ${{ inputs.container_image_tag }}
52+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
53+
VERSION_TAG_TO_APPLY: ${{ inputs.version_tag_to_apply }}
54+
run: |
55+
# Create manifest list combining both architectures
56+
docker buildx imagetools create -t "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:latest" \
57+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64" \
58+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
59+
docker buildx imagetools create -t "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${VERSION_TAG_TO_APPLY}" \
60+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64" \
61+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
62+
63+
- name: Tag images for individual architectures
64+
env:
65+
ECR_REPOSITORY: ${{ inputs.ecr_name }}
66+
IMAGE_TAG: ${{ inputs.container_image_tag }}
67+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
68+
VERSION_TAG_TO_APPLY: ${{ inputs.version_tag_to_apply }}
69+
run: |
70+
# Get the image manifest
71+
MANIFEST=$(aws ecr batch-get-image \
72+
--repository-name "${ECR_REPOSITORY}" \
73+
--image-ids imageTag="${IMAGE_TAG}-amd64" \
74+
--output text --query 'images[].imageManifest')
75+
76+
# Put the image with a new tag using the same manifest
77+
aws ecr put-image --repository-name "${ECR_REPOSITORY}" \
78+
--image-manifest "$MANIFEST" \
79+
--image-tag "${VERSION_TAG_TO_APPLY}-amd64"
80+
aws ecr put-image --repository-name "${ECR_REPOSITORY}" \
81+
--image-manifest "$MANIFEST" \
82+
--image-tag latest-amd64
83+
84+
MANIFEST=$(aws ecr batch-get-image \
85+
--repository-name "${ECR_REPOSITORY}" \
86+
--image-ids imageTag="${IMAGE_TAG}-arm64" \
87+
--output text --query 'images[].imageManifest')
88+
89+
# Put the image with a new tag using the same manifest
90+
aws ecr put-image --repository-name "${ECR_REPOSITORY}" \
91+
--image-manifest "$MANIFEST" \
92+
--image-tag "${VERSION_TAG_TO_APPLY}-arm64"
93+
aws ecr put-image --repository-name "${ECR_REPOSITORY}" \
94+
--image-manifest "$MANIFEST" \
95+
--image-tag latest-arm64
96+
97+
- name: Verify multi-architecture manifest
98+
env:
99+
ECR_REPOSITORY: ${{ inputs.ecr_name }}
100+
IMAGE_TAG: ${{ inputs.container_image_tag }}
101+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
102+
run: |
103+
echo "=== Verifying multi-architecture manifest ==="
104+
docker buildx imagetools inspect "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:latest"

‎.github/workflows/tag_latest_dev_container.yml‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

0 commit comments

Comments
 (0)