Skip to content

Commit a780baf

Browse files
metju-acmetju-ac
committed
refactor: add ecr actions
Usually we use those from github-actions repository, but that is impossible here since this is a public repository. JIRA: INFRA-3992
1 parent 56975cb commit a780baf

File tree

2 files changed

+238
-0
lines changed

2 files changed

+238
-0
lines changed

‎.github/actions/container-build-push/action.yaml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# yamllint disable rule:line-length
2+
---
3+
name: "ecr-container-build-push"
4+
description: "Build a container image and upload it to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
aws-creds-vault-role:
10+
default: ecr-push
11+
description: "Vault auth role for reading AWS credentials"
12+
aws-region:
13+
default: "us-east-1"
14+
description: "AWS region to use for ECR"
15+
ecr-repos:
16+
description: "Repository (as defined in gooddata/terraform-ecr/repositories)"
17+
required: true
18+
ecr-url:
19+
description: "ECR registry default URL (without prefix/suffix)"
20+
required: true
21+
vault-url:
22+
description: "Vault API URL (default okay in almost all cases)"
23+
required: true
24+
build-args:
25+
description: "Arguments for container build file (ARG in Dockerfile)."
26+
required: false
27+
default: ""
28+
build-context:
29+
description: "Context (working directory) where the build should be executed"
30+
default: "."
31+
build-tags:
32+
description: "Tags (newline delimited)"
33+
required: true
34+
container-file:
35+
description: "File (with a path) to use for build"
36+
default: "Dockerfile"
37+
push-image:
38+
description: "Whether to really push to registry"
39+
default: "true"
40+
debug:
41+
description: "Turn on debug messages"
42+
default: "false"
43+
platforms:
44+
description: "List of target platforms for build"
45+
default: "linux/amd64"
46+
labels:
47+
description: "List of labels for image"
48+
default: ""
49+
secrets:
50+
description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
51+
default: ""
52+
secret-envs:
53+
description: "List of secret env vars to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR)"
54+
default: ""
55+
provenance:
56+
description: "Generate provenance attestation for the build"
57+
default: "true"
58+
outputs:
59+
digest:
60+
description: "Image digest"
61+
value: ${{ steps.build_push.outputs.digest }}
62+
imageid:
63+
description: "Image ID"
64+
value: ${{ steps.build_push.outputs.imageid }}
65+
metadata:
66+
description: "Image metadata"
67+
value: ${{ steps.build_push.outputs.metadata }}
68+
runs:
69+
using: "composite"
70+
steps:
71+
- name: Check container file
72+
env:
73+
CONTAINERFILE: ${{ inputs.container-file }}
74+
shell: bash
75+
run: |
76+
test -f $CONTAINERFILE
77+
- name: Get required Vault secrets
78+
id: secrets
79+
uses: hashicorp/vault-action@v3
80+
with:
81+
url: ${{ inputs.vault-url }}
82+
method: jwt
83+
path: jwt/github
84+
role: ${{ inputs.aws-creds-vault-role }}
85+
secrets: |
86+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
87+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
88+
- name: Configure AWS credentials
89+
uses: aws-actions/configure-aws-credentials@v4
90+
with:
91+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
92+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
93+
aws-region: ${{ inputs.aws-region }}
94+
- name: Set up QEMU
95+
uses: docker/setup-qemu-action@v3
96+
with:
97+
platforms: ${{ inputs.platforms }}
98+
- name: Set up Docker Buildx
99+
uses: docker/setup-buildx-action@v3
100+
- name: Expand tags with ECR url and ECR repo
101+
id: expand_tags
102+
env:
103+
ECR_URL: ${{ inputs.ecr-url }}
104+
ECR_REPOS: ${{ inputs.ecr-repos }}
105+
BUILD_TAGS: ${{ inputs.build-tags }}
106+
shell: bash
107+
run: |
108+
eval REPO=$ECR_REPOS
109+
{
110+
echo "EXPANDED_TAGS<<EOF"
111+
for BTAG in $BUILD_TAGS; do
112+
echo $ECR_URL/$REPO:$BTAG
113+
done
114+
echo EOF
115+
} >> "$GITHUB_ENV"
116+
echo "REPO=$REPO" >> "$GITHUB_ENV"
117+
- name: Build and push Docker images
118+
uses: docker/build-push-action@v6
119+
id: build_push
120+
with:
121+
file: ${{ inputs.container-file }}
122+
context: ${{ inputs.build-context }}
123+
push: ${{ inputs.push-image }}
124+
tags: ${{ env.EXPANDED_TAGS }}
125+
build-args: ${{ inputs.build-args }}
126+
platforms: ${{ inputs.platforms }}
127+
cache-from: type=registry,ref=${{ inputs.ecr-url }}/${{ env.REPO }}:buildcache
128+
cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ inputs.ecr-url }}/${{ env.REPO }}:buildcache
129+
labels: ${{ inputs.labels }}
130+
secrets: ${{ inputs.secrets }}
131+
secret-envs: ${{ inputs.secret-envs }}
132+
provenance: ${{ inputs.provenance }}

‎.github/actions/helm-push/action.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
# yamllint disable rule:line-length
3+
name: "ecr-helm-push"
4+
description: "Package a Helm chart and upload to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
type: string
10+
aws-creds-vault-role:
11+
description: "Vault auth role for reading AWS credentials"
12+
type: string
13+
required: true
14+
aws-region:
15+
default: "us-east-1"
16+
description: "AWS region to use for ECR"
17+
type: string
18+
ecr-repo-prefix:
19+
description: "Repository prefix (without Chart name)"
20+
type: string
21+
required: true
22+
ecr-url:
23+
description: "ECR registry default URL (without prefix/suffix)"
24+
type: string
25+
required: true
26+
path:
27+
description: "Path to directory containing Chart.yaml"
28+
required: true
29+
type: string
30+
package-destination:
31+
default: "."
32+
description: "Where to put helm-built package"
33+
type: string
34+
package-app-version:
35+
default: ""
36+
description: "Application version"
37+
type: string
38+
package-version:
39+
default: ""
40+
description: "Helm chart version - used by `helm package`"
41+
type: string
42+
vault-url:
43+
description: "Vault API URL (default okay in almost all cases)"
44+
required: true
45+
checkout-code:
46+
default: "true"
47+
description: "Checkout fresh code from repository"
48+
type: string
49+
dependency-update:
50+
default: "true"
51+
description: "Run helm dependency update before packaging"
52+
type: string
53+
dry-run:
54+
default: "false"
55+
type: string
56+
description: "Dry-run (do not upload to ECR)"
57+
runs:
58+
using: "composite"
59+
steps:
60+
- name: Checkout code
61+
if: ${{ inputs.checkout-code == 'true' }}
62+
uses: actions/checkout@v5
63+
- name: Install helm binary
64+
uses: azure/setup-helm@v4
65+
with:
66+
version: 'v3.12.1'
67+
- name: Get required Vault secrets
68+
if: ${{ inputs.dry-run == 'false' }}
69+
id: secrets
70+
uses: hashicorp/vault-action@v3
71+
with:
72+
url: ${{ inputs.vault-url }}
73+
method: jwt
74+
path: jwt/github
75+
role: ${{ inputs.aws-creds-vault-role }}
76+
secrets: |
77+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
78+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
79+
- name: Configure AWS credentials
80+
if: ${{ inputs.dry-run == 'false' }}
81+
uses: aws-actions/configure-aws-credentials@v4
82+
with:
83+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
84+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
85+
aws-region: ${{ inputs.aws-region }}
86+
- name: Login to Amazon ECR
87+
if: ${{ inputs.dry-run == 'false' }}
88+
id: login-ecr
89+
uses: aws-actions/amazon-ecr-login@v2
90+
- name: Package chart
91+
id: package-chart
92+
env:
93+
DESTINATION: ${{ inputs.package-destination }}
94+
APP_VERSION: ${{ inputs.package-app-version }}
95+
VERSION: ${{ inputs.package-version }}
96+
run: |
97+
# helm package doesn't allow custom target name, so we have to parse it this way
98+
pkgfile=$(helm package ${DESTINATION:+--destination $DESTINATION} ${APP_VERSION:+--app-version $APP_VERSION} ${VERSION:+--version $VERSION} ${{ inputs.dependency-update == 'true' && '--dependency-update' || '' }} ${{ inputs.path }} | tee | awk '{print $NF}')
99+
echo "pkgfile=$pkgfile" >> $GITHUB_OUTPUT
100+
shell: bash
101+
- name: Push chart to ECR
102+
if: ${{ inputs.dry-run == 'false' }}
103+
run: |
104+
helm push ${{ steps.package-chart.outputs.pkgfile }} oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}
105+
echo "Pushed ${{ steps.package-chart.outputs.pkgfile }} to oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}" >> $GITHUB_STEP_SUMMARY
106+
shell: bash

0 commit comments

Comments
 (0)