chore: use new docker publish workflow (#3067)

Author: yashmehrotra

.github/workflows/publish.yaml

@@ -22,68 +22,38 @@ jobs:
 
   docker:
     needs: semantic-release
-    runs-on: ubuntu-latest
     if: ${{ needs.semantic-release.outputs.published == 'true' }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@446798f8213ac2e75931c1b0769676d927801858 # v2.10.3
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.ECR_AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
-      - name: Login to Amazon ECR Public
-        id: login-ecr-public
-        uses: aws-actions/amazon-ecr-login@v2
-        with:
-          registry-type: public
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Set up Docker Buildx # must be executed before a step that contains platforms
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: cloud
-          endpoint: flanksource/node
-
-      - name: Build & Push Canary Checker UI to Docker Hub and ECR Public
-        uses: docker/build-push-action@v6
-        with:
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            flanksource/canary-checker-ui:latest
-            flanksource/canary-checker-ui:v${{ needs.semantic-release.outputs.version }}
-            ${{ steps.login-ecr-public.outputs.registry }}/k4y9r6y5/canary-checker-ui:latest
-            ${{ steps.login-ecr-public.outputs.registry }}/k4y9r6y5/canary-checker-ui:v${{ needs.semantic-release.outputs.version }}
-          build-args: |
-            APP_DEPLOYMENT=CANARY_CHECKER
-            WITHOUT_AUTH=true
-
-      - name: Build & Push Incident Manager UI to Docker Hub and ECR Public
-        uses: docker/build-push-action@v6
-        with:
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            flanksource/incident-manager-ui:latest
-            flanksource/incident-manager-ui:v${{ needs.semantic-release.outputs.version }}
-            ${{ steps.login-ecr-public.outputs.registry }}/k4y9r6y5/incident-manager-ui:latest
-            ${{ steps.login-ecr-public.outputs.registry }}/k4y9r6y5/incident-manager-ui:v${{ needs.semantic-release.outputs.version }}
-          build-args: |
-            APP_DEPLOYMENT=INCIDENT_MANAGER
-            WITHOUT_AUTH=false
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: canary-checker-ui
+            build_args: |
+              APP_DEPLOYMENT=CANARY_CHECKER
+              WITHOUT_AUTH=true
+          - image: incident-manager-ui
+            build_args: |
+              APP_DEPLOYMENT=INCIDENT_MANAGER
+              WITHOUT_AUTH=false
+    uses: flanksource/action-workflows/.github/workflows/publish-docker-image.yml@main
+    with:
+      platforms: linux/amd64,linux/arm64
+      login_to_ecr: true
+      image_tags: |
+        flanksource/${{ matrix.image }}:latest
+        flanksource/${{ matrix.image }}:v${{ needs.semantic-release.outputs.version }}
+        public.ecr.aws/k4y9r6y5/${{ matrix.image }}:latest
+        public.ecr.aws/k4y9r6y5/${{ matrix.image }}:v${{ needs.semantic-release.outputs.version }}
+      build_args: ${{ matrix.build_args }}
+    secrets:
+      docker_username: ${{ secrets.DOCKER_USERNAME }}
+      docker_password: ${{ secrets.DOCKER_PASSWORD }}
+      aws_access_key_id: ${{ secrets.ECR_AWS_ACCESS_KEY }}
+      aws_secret_access_key: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }}
 
   helm:
     runs-on: ubuntu-latest