nhost/.github/workflows/wf_docker_push_image_ecr.yaml at main · superstruct/nhost · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
---
on:
  workflow_call:
    inputs:
      NAME:
        type: string
        required: true
      PATH:
        type: string
        required: true
      VERSION:
        type: string
        required: true

    secrets:
      AWS_ACCOUNT_ID:
        required: true
      CONTAINER_REGISTRY:
        required: true

jobs:
  push-to-registry:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    permissions:
      id-token: write
      contents: write

    defaults:
      run:
        working-directory: ${{ inputs.PATH }}

    steps:
      - name: "Check out repository"
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: true

      - name: Configure aws
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-nhost-${{ github.event.repository.name }}
          aws-region: eu-central-1

      - name: "Login to Amazon ECR"
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: 'true'

      - name: "Compute common env vars"
        id: vars
        run: |
          echo "VERSION=$(make get-version VER=${{ inputs.VERSION }})" >> $GITHUB_OUTPUT

      - name: "Get artifacts"
        uses: actions/download-artifact@v7
        with:
          path: ~/artifacts

      - name: "Inspect artifacts"
        run: find ~/artifacts

      - name: "Push docker image to docker hub"
        run: |
          export NAME=${{ inputs.NAME }}
          export VERSION=${{ steps.vars.outputs.VERSION }}
          export CONTAINER_REGISTRY=${{ secrets.CONTAINER_REGISTRY }}
          export CONTAINER_NAME=$CONTAINER_REGISTRY/$NAME

          for ARCH in "x86_64" "aarch64"; do
            skopeo copy --insecure-policy \
              dir:/home/runner/artifacts/${{ inputs.NAME }}-docker-image-$ARCH-$VERSION \
              docker-daemon:$CONTAINER_NAME:$VERSION-$ARCH
            docker push $CONTAINER_NAME:$VERSION-$ARCH
          done

          docker manifest create \
            $CONTAINER_NAME:$VERSION \
            --amend $CONTAINER_NAME:$VERSION-x86_64 \
            --amend $CONTAINER_NAME:$VERSION-aarch64

          docker manifest push $CONTAINER_NAME:$VERSION