Skip to content

Commit bf466bc

Browse files
metju-acmetju-ac
committed
refactor: add ecr actions
JIRA: INFRA-3992
1 parent 25dca51 commit bf466bc

File tree

2 files changed

+240
-0
lines changed

2 files changed

+240
-0
lines changed

‎.github/actions/container-build-push/action.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# yamllint disable rule:line-length
2+
---
3+
name: "ecr-container-build-push"
4+
description: "Build a container image and upload it to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
aws-creds-vault-role:
10+
default: ecr-push
11+
description: "Vault auth role for reading AWS credentials"
12+
aws-region:
13+
default: "us-east-1"
14+
description: "AWS region to use for ECR"
15+
ecr-repos:
16+
description: "Repository (as defined in gooddata/terraform-ecr/repositories)"
17+
required: true
18+
ecr-url:
19+
default: "020413372491.dkr.ecr.us-east-1.amazonaws.com"
20+
description: "ECR registry default URL (without prefix/suffix)"
21+
vault-url:
22+
description: "Vault API URL (default okay in almost all cases)"
23+
required: false
24+
default: "https://vault.ord1.infra.intgdc.com"
25+
build-args:
26+
description: "Arguments for container build file (ARG in Dockerfile)."
27+
required: false
28+
default: ""
29+
build-context:
30+
description: "Context (working directory) where the build should be executed"
31+
default: "."
32+
build-tags:
33+
description: "Tags (newline delimited)"
34+
required: true
35+
container-file:
36+
description: "File (with a path) to use for build"
37+
default: "Dockerfile"
38+
push-image:
39+
description: "Whether to really push to registry"
40+
default: "true"
41+
debug:
42+
description: "Turn on debug messages"
43+
default: "false"
44+
platforms:
45+
description: "List of target platforms for build"
46+
default: "linux/amd64"
47+
labels:
48+
description: "List of labels for image"
49+
default: ""
50+
secrets:
51+
description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
52+
default: ""
53+
secret-envs:
54+
description: "List of secret env vars to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR)"
55+
default: ""
56+
provenance:
57+
description: "Generate provenance attestation for the build"
58+
default: "true"
59+
outputs:
60+
digest:
61+
description: "Image digest"
62+
value: ${{ steps.build_push.outputs.digest }}
63+
imageid:
64+
description: "Image ID"
65+
value: ${{ steps.build_push.outputs.imageid }}
66+
metadata:
67+
description: "Image metadata"
68+
value: ${{ steps.build_push.outputs.metadata }}
69+
runs:
70+
using: "composite"
71+
steps:
72+
- name: Check container file
73+
env:
74+
CONTAINERFILE: ${{ inputs.container-file }}
75+
shell: bash
76+
run: |
77+
test -f $CONTAINERFILE
78+
- name: Get required Vault secrets
79+
id: secrets
80+
uses: hashicorp/vault-action@v3
81+
with:
82+
url: ${{ inputs.vault-url }}
83+
method: jwt
84+
path: jwt/github
85+
role: ${{ inputs.aws-creds-vault-role }}
86+
secrets: |
87+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
88+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
89+
- name: Configure AWS credentials
90+
uses: aws-actions/configure-aws-credentials@v4
91+
with:
92+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
93+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
94+
aws-region: ${{ inputs.aws-region }}
95+
- name: Set up QEMU
96+
uses: docker/setup-qemu-action@v3
97+
with:
98+
platforms: ${{ inputs.platforms }}
99+
- name: Set up Docker Buildx
100+
uses: docker/setup-buildx-action@v3
101+
- name: Expand tags with ECR url and ECR repo
102+
id: expand_tags
103+
env:
104+
ECR_URL: ${{ inputs.ecr-url }}
105+
ECR_REPOS: ${{ inputs.ecr-repos }}
106+
BUILD_TAGS: ${{ inputs.build-tags }}
107+
shell: bash
108+
run: |
109+
eval REPO=$ECR_REPOS
110+
{
111+
echo "EXPANDED_TAGS<<EOF"
112+
for BTAG in $BUILD_TAGS; do
113+
echo $ECR_URL/$REPO:$BTAG
114+
done
115+
echo EOF
116+
} >> "$GITHUB_ENV"
117+
echo "REPO=$REPO" >> "$GITHUB_ENV"
118+
- name: Build and push Docker images
119+
uses: docker/build-push-action@v6
120+
id: build_push
121+
with:
122+
file: ${{ inputs.container-file }}
123+
context: ${{ inputs.build-context }}
124+
push: ${{ inputs.push-image }}
125+
tags: ${{ env.EXPANDED_TAGS }}
126+
build-args: ${{ inputs.build-args }}
127+
platforms: ${{ inputs.platforms }}
128+
cache-from: type=registry,ref=${{ inputs.ecr-url }}/${{ env.REPO }}:buildcache
129+
cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ inputs.ecr-url }}/${{ env.REPO }}:buildcache
130+
labels: ${{ inputs.labels }}
131+
secrets: ${{ inputs.secrets }}
132+
secret-envs: ${{ inputs.secret-envs }}
133+
provenance: ${{ inputs.provenance }}

‎.github/actions/helm-push/action.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
---
2+
# yamllint disable rule:line-length
3+
name: "ecr-helm-push"
4+
description: "Package a Helm chart and upload to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
type: string
10+
aws-creds-vault-role:
11+
default: ecr-push
12+
description: "Vault auth role for reading AWS credentials"
13+
type: string
14+
aws-region:
15+
default: "us-east-1"
16+
description: "AWS region to use for ECR"
17+
type: string
18+
ecr-repo-prefix:
19+
default: "helm/gooddata"
20+
description: "Repository prefix (without Chart name)"
21+
type: string
22+
ecr-url:
23+
default: "020413372491.dkr.ecr.us-east-1.amazonaws.com"
24+
description: "ECR registry default URL (without prefix/suffix)"
25+
type: string
26+
path:
27+
description: "Path to directory containing Chart.yaml"
28+
required: true
29+
type: string
30+
package-destination:
31+
default: "."
32+
description: "Where to put helm-built package"
33+
type: string
34+
package-app-version:
35+
default: ""
36+
description: "Application version"
37+
type: string
38+
package-version:
39+
default: ""
40+
description: "Helm chart version - used by `helm package`"
41+
type: string
42+
vault-url:
43+
description: "Vault API URL (default okay in almost all cases)"
44+
required: false
45+
default: "https://vault.ord1.infra.intgdc.com"
46+
checkout-code:
47+
default: "true"
48+
description: "Checkout fresh code from repository"
49+
type: string
50+
dependency-update:
51+
default: "true"
52+
description: "Run helm dependency update before packaging"
53+
type: string
54+
dry-run:
55+
default: "false"
56+
type: string
57+
description: "Dry-run (do not upload to ECR)"
58+
runs:
59+
using: "composite"
60+
steps:
61+
- name: Checkout code
62+
if: ${{ inputs.checkout-code == 'true' }}
63+
uses: actions/checkout@v5
64+
- name: Install helm binary
65+
uses: azure/setup-helm@v4
66+
with:
67+
version: 'v3.12.1'
68+
- name: Get required Vault secrets
69+
if: ${{ inputs.dry-run == 'false' }}
70+
id: secrets
71+
uses: hashicorp/vault-action@v3
72+
with:
73+
url: ${{ inputs.vault-url }}
74+
method: jwt
75+
path: jwt/github
76+
role: ${{ inputs.aws-creds-vault-role }}
77+
secrets: |
78+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
79+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
80+
- name: Configure AWS credentials
81+
if: ${{ inputs.dry-run == 'false' }}
82+
uses: aws-actions/configure-aws-credentials@v4
83+
with:
84+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
85+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
86+
aws-region: ${{ inputs.aws-region }}
87+
- name: Login to Amazon ECR
88+
if: ${{ inputs.dry-run == 'false' }}
89+
id: login-ecr
90+
uses: aws-actions/amazon-ecr-login@v2
91+
- name: Package chart
92+
id: package-chart
93+
env:
94+
DESTINATION: ${{ inputs.package-destination }}
95+
APP_VERSION: ${{ inputs.package-app-version }}
96+
VERSION: ${{ inputs.package-version }}
97+
run: |
98+
# helm package doesn't allow custom target name, so we have to parse it this way
99+
pkgfile=$(helm package ${DESTINATION:+--destination $DESTINATION} ${APP_VERSION:+--app-version $APP_VERSION} ${VERSION:+--version $VERSION} ${{ inputs.dependency-update == 'true' && '--dependency-update' || '' }} ${{ inputs.path }} | tee | awk '{print $NF}')
100+
echo "pkgfile=$pkgfile" >> $GITHUB_OUTPUT
101+
shell: bash
102+
- name: Push chart to ECR
103+
if: ${{ inputs.dry-run == 'false' }}
104+
run: |
105+
helm push ${{ steps.package-chart.outputs.pkgfile }} oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}
106+
echo "Pushed ${{ steps.package-chart.outputs.pkgfile }} to oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}" >> $GITHUB_STEP_SUMMARY
107+
shell: bash

0 commit comments

Comments
 (0)