ecr_image_push.yaml

name: ECR Image Push
# This Action builds the Docker image and pushes it to ECR

on:
  workflow_dispatch:
  release:
    types: ["published"]

jobs:
  deploy:
    name: Build & Push
    runs-on: ubuntu-latest

    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ secrets.OIDC_GITHUB_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_ECR_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Build, tag, and push image to Amazon ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.AWS_ECR_PRIVATE_REPO }}
          TRIGGER_EVENT_NAME: ${{ github.event_name }}
        run: |
          IMAGE_REPO="$ECR_REGISTRY/$ECR_REPOSITORY"
          IMAGE_TAGS=('latest')

          REF="${GITHUB_REF#refs/*/}" && REF_TAG="${REF%/merge}"

          if [ "$TRIGGER_EVENT_NAME" == 'release' ]; then
            [ "$REF_TAG" == 'main' ] && REF_TAG='prod';
            [ "$REF_TAG" == 'next' ] && REF_TAG='staging';

            VERSION_TAG="v$( jq '.version' < ./package.json | tr -d '"' )"
            IMAGE_TAGS+=("$VERSION_TAG")
          fi

          IMAGE_TAGS+=("$REF_TAG")
          IMAGE_TAGS=("${IMAGE_TAGS[@]/#/$IMAGE_REPO:}")

          # shellcheck disable=SC2068 # <-- Word splitting intended.
          docker build ${IMAGE_TAGS[@]/#/-t } .

          for tag in "${IMAGE_TAGS[@]}"; do docker push "$tag"; done

# The above REF_TAG value will be the variable component of the GITHUB_REF env var,
# the value of which depends on the type of event which caused the Action to run.
#
#   EVENT           REF                             IMAGE_TAG
#   branch push     refs/heads/<branch_name>        <branch_name>
#   pr              refs/pull/<pr_number>/merge     <pr_number>
#   release         refs/tags/<release_tag>         <release_tag>
#
# If the action was triggered by a RELEASE event on the "main" or "next" branches, the
# REF_TAG is converted into "prod" or "staging" respectively, and a VERSION_TAG is
# added using the value of the "version" field in the package.json.