@@ -169,57 +169,60 @@ jobs:
169169 -f superchain/Dockerfile \
170170 .
171171
172+ # Re-authenticate to ECR Public, this time with image-push permissions
173+ - name : Federate with AWS role for ECR Public push
174+ if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && (github.ref == 'refs/heads/release' || github.ref == 'refs/heads/main')
175+ uses : aws-actions/configure-aws-credentials@v2
176+ with :
177+ aws-region : us-east-1
178+ role-to-assume : ${{ secrets.AWS_ROLE_TO_ASSUME_FOR_ECR_PUBLIC_PUSH }}
179+ role-session-name : GHA_aws-jsii_docker-images-PUSH
180+ - name : Authenticate with ECR Public for Push
181+ if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && (github.ref == 'refs/heads/release' || github.ref == 'refs/heads/main')
182+ uses : aws-actions/amazon-ecr-login@v1
183+ with :
184+ registry-type : public
185+
172186 # Only when puhsing to main/release from now on
173187 - name : Publish (nightly)
174- if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && github.ref != 'refs/heads/release '
188+ if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main '
175189 # NOTE BELOW: The `--tag` flags can be provided multiple times... we use that capability...
176190 run : |-
177191 # If the current version is the default version, also tag this with the unqualified ':nightly' label
178192 if [[ "${{ matrix.node }}" == "$DEFAULT_NODE_MAJOR_VERSION" ]]; then
179- docker buildx build \
180- --builder ${{ steps.buildx.outputs.name }} \
181- --platform linux/amd64,linux/arm64 \
182- --target superchain \
183- --cache-from type=local,src=/tmp/.buildx-cache \
184- --cache-to type=local,dest=/tmp/.buildx-cache \
185- --push \
186- --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
187- --build-arg COMMIT_ID='${{ github.sha }}' \
188- --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
189- --tag "jsii/superchain:1-buster-slim-nightly" \
190- --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}-nightly"\
191- -f superchain/Dockerfile \
193+ docker buildx build \
194+ --builder ${{ steps.buildx.outputs.name }} \
195+ --platform linux/amd64,linux/arm64 \
196+ --target superchain \
197+ --cache-from type=local,src=/tmp/.buildx-cache \
198+ --cache-to type=local,dest=/tmp/.buildx-cache \
199+ --push \
200+ --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
201+ --build-arg COMMIT_ID='${{ github.sha }}' \
202+ --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
203+ --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim-nightly" \
204+ --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim-node${{ matrix.node }}-nightly" \
205+ --tag "jsii/superchain:1-buster-slim-nightly" \
206+ --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}-nightly" \
207+ -f superchain/Dockerfile \
192208 .
193209 else
194- docker buildx build \
195- --builder ${{ steps.buildx.outputs.name }} \
196- --platform linux/amd64,linux/arm64 \
197- --target superchain \
198- --cache-from type=local,src=/tmp/.buildx-cache \
199- --cache-to type=local,dest=/tmp/.buildx-cache \
200- --push \
201- --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
202- --build-arg COMMIT_ID='${{ github.sha }}' \
203- --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
204- --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}-nightly"\
205- -f superchain/Dockerfile \
210+ docker buildx build \
211+ --builder ${{ steps.buildx.outputs.name }} \
212+ --platform linux/amd64,linux/arm64 \
213+ --target superchain \
214+ --cache-from type=local,src=/tmp/.buildx-cache \
215+ --cache-to type=local,dest=/tmp/.buildx-cache \
216+ --push \
217+ --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
218+ --build-arg COMMIT_ID='${{ github.sha }}' \
219+ --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
220+ --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim-node${{ matrix.node }}-nightly" \
221+ --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}-nightly" \
222+ -f superchain/Dockerfile \
206223 .
207224 fi
208225
209- # We only switch to an ECR-Push capable role if this is a "release" push, for safety reasons...
210- - name : Federate with AWS role for ECE Public push
211- if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/release'
212- uses : aws-actions/configure-aws-credentials@v2
213- with :
214- aws-region : us-east-1
215- role-to-assume : ${{ secrets.AWS_ROLE_TO_ASSUME_FOR_ECR_PUBLIC_PUSH }}
216- role-session-name : GHA_aws-jsii_docker-images-PUSH
217- - name : Authenticate with ECR Public for Push
218- if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/release'
219- uses : aws-actions/amazon-ecr-login@v1
220- with :
221- registry-type : public
222-
223226 - name : Publish (latest)
224227 if : steps.should-run.outputs.result == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/release'
225228 # NOTE BELOW: The `--tag` flags can be provided multiple times... we use that capability...
@@ -236,10 +239,10 @@ jobs:
236239 --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
237240 --build-arg COMMIT_ID='${{ github.sha }}' \
238241 --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
239- --tag "jsii/superchain:1-buster-slim" \
240- --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}" \
241242 --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim" \
242243 --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim-node${{ matrix.node }}" \
244+ --tag "jsii/superchain:1-buster-slim" \
245+ --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}" \
243246 -f superchain/Dockerfile \
244247 .
245248 else
@@ -253,8 +256,8 @@ jobs:
253256 --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
254257 --build-arg COMMIT_ID='${{ github.sha }}' \
255258 --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
256- --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}" \
257259 --tag "${{ secrets.ECR_PUBLIC_REGISTRY }}:1-buster-slim-node${{ matrix.node }}" \
260+ --tag "jsii/superchain:1-buster-slim-node${{ matrix.node }}" \
258261 -f superchain/Dockerfile \
259262 .
260263 fi
0 commit comments