Skip to content

Commit 1e93feb

Browse files
tobyhedetobyhede
authored
Merge pull request #173 from cipherstash/build/release-aws-marketplace
build: aws marketplace release
2 parents 95dbbba + fd663cc commit 1e93feb

File tree

3 files changed

+124
-8
lines changed

3 files changed

+124
-8
lines changed

‎.github/workflows/release-aws-marketplace.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Builds and pushes the proxy docker image to the AWS Marketplace ECR
2+
#
3+
# here: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
4+
#
5+
#
6+
# ECR is a private registry that is not controlled by us
7+
# Most of the existing Docker actions are not compatible with ECR, so some of this is quite manual
8+
#
9+
# Builds for different images are handled using tags, because I could not get other things workings.
10+
#
11+
# The tag formats are:
12+
# - proxy-{os}-{arch}-{release-tag}
13+
# - proxy-{os}-{arch}-build-{timestamp}
14+
#
15+
# ECR is immutable - so test builds need a timestamp or they fail with a conflicts
16+
17+
name: "Proxy — Build & Push Proxy Docker Image for AWS Marketplace"
18+
19+
on:
20+
release:
21+
types:
22+
- published
23+
pull_request:
24+
branches:
25+
- main
26+
paths:
27+
- .github/workflows/release-aws-marketplace.yml
28+
29+
workflow_dispatch:
30+
31+
32+
env:
33+
REGISTRY_IMAGE: cipherstash/cipherstash
34+
AWS_REGION: us-east-1
35+
36+
jobs:
37+
build:
38+
name: 🏗️ Build binaries + Docker images
39+
permissions:
40+
contents: read
41+
packages: write
42+
id-token: write # This is required for requesting the JWT
43+
strategy:
44+
fail-fast: false
45+
matrix:
46+
build:
47+
- { os: linux-arm64-public, arch: linux/arm64, tag: linux-arm64, cache-provider: github }
48+
runs-on: ${{matrix.build.os}}
49+
steps:
50+
51+
- name: install-aws-cli
52+
uses: unfor19/install-aws-cli-action@v1
53+
if: ${{ matrix.build.arch == 'linux/arm64' }}
54+
with:
55+
version: 2 # default
56+
verbose: false # default
57+
arch: arm64 # allowed values: amd64, arm64
58+
59+
- name: Configure AWS credentials
60+
uses: aws-actions/configure-aws-credentials@v4
61+
with:
62+
role-to-assume: ${{ vars.AWS_MARKETPLACE_IAM_ROLE }}
63+
aws-region: us-east-1
64+
65+
- name: Log in to AWS Marketplace ECR
66+
id: ecr-login
67+
uses: aws-actions/amazon-ecr-login@v2
68+
with:
69+
registries: ${{ vars.AWS_MARKETPLACE_ECR_ID }}
70+
71+
- uses: actions/checkout@v4
72+
73+
- name: Setup Rust cache
74+
uses: Swatinem/rust-cache@v2
75+
with:
76+
cache-provider: ${{matrix.build.cache-provider}}
77+
cache-all-crates: true
78+
79+
- uses: jdx/mise-action@v2
80+
with:
81+
version: 2025.1.6 # [default: latest] mise version to install
82+
install: true # [default: true] run `mise install`
83+
cache: true # [default: true] cache mise using GitHub's cache
84+
85+
- run: |
86+
mise run build --platform ${{matrix.build.arch}}
87+
88+
- uses: actions/upload-artifact@v4
89+
with:
90+
name: cipherstash-proxy-${{matrix.build.tag}}
91+
path: cipherstash-proxy
92+
93+
- if: github.event_name != 'pull_request'
94+
name: Release to AWS
95+
env:
96+
AWS_MARKETPLACE_ECR_REPOSITORY: ${{ vars.AWS_MARKETPLACE_ECR_REPOSITORY }}
97+
BUILD_TAG: ${{ matrix.build.tag }}
98+
RELEASE_TAG: ${{ github.event.release.tag_name }}
99+
run: |
100+
mise run release:aws-marketplace
101+
102+

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
cache-all-crates: true
3030
- uses: jdx/mise-action@v2
3131
with:
32-
version: 2024.12.0 # [default: latest] mise version to install
32+
version: 2025.1.6 # [default: latest] mise version to install
3333
install: true # [default: true] run `mise install`
3434
cache: true # [default: true] cache mise using GitHub's cache
3535
- run: |

‎mise.toml‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,27 @@ docker tag cipherstash/proxy:latest cipherstash/proxy:latest
561561
docker push cipherstash/proxy:latest
562562
"""
563563

564+
[tasks."release:aws-marketplace"]
565+
description = "Release a Docker image to AWS Marketplace for cipherstash-proxy"
566+
run = """
567+
if [ -z "$AWS_MARKETPLACE_ECR_REPOSITORY" ]; then
568+
echo "error: no AWS ECR repository provided"
569+
echo "error: please set AWS_MARKETPLACE_ECR_REPOSITORY"
570+
exit 2
571+
fi
572+
573+
# If release tag is empty, generate a build timestamp
574+
# Release tag is set when tagging as an actual version github release.
575+
if [ -z "$RELEASE_TAG" ]; then
576+
RELEASE_TAG=build-$(date +%s)
577+
fi
578+
579+
echo $AWS_MARKETPLACE_ECR_REPOSITORY:proxy-$BUILD_TAG-$RELEASE_TAG
580+
581+
docker tag cipherstash/proxy:latest $AWS_MARKETPLACE_ECR_REPOSITORY:proxy-$BUILD_TAG-$RELEASE_TAG
582+
583+
docker push $AWS_MARKETPLACE_ECR_REPOSITORY:proxy-$BUILD_TAG-$RELEASE_TAG
584+
"""
564585

565586
# ====================================================================================================
566587

@@ -572,10 +593,3 @@ run = """
572593
openssl req -new -x509 -days 365 -nodes -out server.cert -keyout server.key -subj "/CN=localhost"
573594
chmod 600 server.cert server.key
574595
"""
575-
576-
# openssl req -x509 -in server.req -text -key server.key -out server.crt │
577-
# openssl rsa -in privkey.pem -out server.key │
578-
# openssl req -x509 -in server.req -text -key server.key -out server.crt
579-
# openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
580-
# -nodes -keyout example.com.key -out example.com.crt -subj "/CN=example.com" \
581-
# -addext "subjectAltName=DNS:example.com,DNS:*.example.com,IP:10.0.0.1"

0 commit comments

Comments
 (0)