Skip to content

Commit ca0b67d

Browse files
anthony-nhsanthony-nhs
committed
add it back in
1 parent 1081c77 commit ca0b67d

File tree

1 file changed

+161
-0
lines changed

1 file changed

+161
-0
lines changed

‎.github/workflows/quality-checks.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -419,3 +419,164 @@ jobs:
419419
with:
420420
name: cfn_guard_output
421421
path: cfn_guard_output
422+
423+
build_dev_container_x64:
424+
permissions:
425+
id-token: write
426+
runs-on: ubuntu-22.04
427+
steps:
428+
- name: Checkout code
429+
uses: actions/checkout@v5
430+
with:
431+
fetch-depth: 0
432+
433+
- name: Download check_ecr_image_scan_results.sh script
434+
env:
435+
SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
436+
run: |
437+
curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
438+
chmod +x check_ecr_image_scan_results.sh
439+
- name: Build dev container
440+
run: |
441+
docker build -f .devcontainer/Dockerfile -t dev-container-image .
442+
443+
- name: Configure AWS Credentials
444+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
445+
id: connect-aws-deploy
446+
with:
447+
aws-region: eu-west-2
448+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
449+
role-session-name: dev-container-build-x64
450+
output-credentials: true
451+
452+
- name: Retrieve AWS Account ID
453+
id: retrieve-deploy-account-id
454+
run: |
455+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
456+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
457+
458+
- name: Login to Amazon ECR
459+
run: |
460+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
461+
462+
- name: Push x64 image to Amazon ECR
463+
env:
464+
ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
465+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
466+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
467+
run: |
468+
docker tag "dev-container-image" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
469+
docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
470+
- name: Check dev container scan results
471+
env:
472+
REPOSITORY_NAME: ${{ inputs.dev_container_ecr }}
473+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}-amd64
474+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
475+
run: |
476+
sleep 30
477+
./check_ecr_image_scan_results.sh
478+
479+
build_dev_container_arm64:
480+
permissions:
481+
id-token: write
482+
runs-on: ubuntu-22.04-arm
483+
steps:
484+
- name: Checkout code
485+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
486+
with:
487+
fetch-depth: 0
488+
489+
- name: Download check_ecr_image_scan_results.sh script
490+
env:
491+
SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
492+
run: |
493+
curl -L "https://raw.githubusercontent.com/NHSDigital/eps-common-workflows/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
494+
chmod +x check_ecr_image_scan_results.sh
495+
496+
- name: Build dev container
497+
run: |
498+
docker build -f .devcontainer/Dockerfile -t dev-container-image-arm .
499+
500+
- name: Configure AWS Credentials
501+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
502+
id: connect-aws-deploy
503+
with:
504+
aws-region: eu-west-2
505+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
506+
role-session-name: dev-container-build-arm64
507+
output-credentials: true
508+
509+
- name: Retrieve AWS Account ID
510+
id: retrieve-deploy-account-id
511+
run: |
512+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
513+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
514+
515+
- name: Login to Amazon ECR
516+
run: |
517+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
518+
519+
- name: Push ARM64 image to Amazon ECR
520+
env:
521+
ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
522+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
523+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
524+
run: |
525+
docker tag "dev-container-image-arm" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
526+
docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
527+
- name: Check dev container scan results
528+
env:
529+
REPOSITORY_NAME: ${{ inputs.dev_container_ecr }}
530+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}-arm64
531+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
532+
run: |
533+
# Wait a moment for ECR to process the new manifest
534+
sleep 30
535+
./check_ecr_image_scan_results.sh
536+
537+
create_multi_arch_manifest:
538+
permissions:
539+
id-token: write
540+
runs-on: ubuntu-22.04
541+
needs: [build_dev_container_x64, build_dev_container_arm64]
542+
steps:
543+
- name: Set up Docker Buildx
544+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
545+
546+
- name: Configure AWS Credentials
547+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
548+
with:
549+
aws-region: eu-west-2
550+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
551+
role-session-name: multi-arch-manifest
552+
output-credentials: true
553+
554+
- name: Retrieve AWS Account ID
555+
id: retrieve-deploy-account-id
556+
run: |
557+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
558+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
559+
560+
- name: Login to Amazon ECR
561+
run: |
562+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
563+
564+
- name: Create and push multi-architecture manifest for tag
565+
env:
566+
ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
567+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
568+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
569+
run: |
570+
# Create manifest list combining both architectures
571+
docker buildx imagetools create -t "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}" \
572+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64" \
573+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
574+
575+
- name: Verify multi-architecture manifest
576+
env:
577+
ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
578+
IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
579+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
580+
run: |
581+
echo "=== Verifying multi-architecture manifest ==="
582+
docker buildx imagetools inspect "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}"

0 commit comments

Comments
 (0)