Skip to content

Commit 93695fd

Browse files
gonzalomarcotegonzalomarcote
committed
Migrating to ECR and docker distroless images
1 parent ffaeb6a commit 93695fd

15 files changed

+309
-176
lines changed

‎.github/workflows/build-and-deploy.yaml‎

Lines changed: 46 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,53 @@
11
name: "Build and deploy"
22

33
on:
4-
push:
5-
branches:
6-
- main
4+
push:
5+
branches:
6+
- main
77

88
concurrency:
9-
# Cancel old runs if there is a new commit in the same branch
10-
group: ${{ github.workflow }}-${{ github.ref }}
11-
cancel-in-progress: true
9+
# Cancel old runs if there is a new commit in the same branch
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
1212

1313
jobs:
14-
15-
build-base:
16-
uses: ./.github/workflows/build-base.yaml
17-
secrets: inherit
18-
with:
19-
push: true
20-
tag: ${{ github.sha }}
21-
22-
build-relayer:
23-
needs: [build-base]
24-
uses: ./.github/workflows/build-relayer.yaml
25-
secrets: inherit
26-
with:
27-
push: true
28-
target: release
29-
base_image: ${{ github.sha }}
30-
31-
build-attester:
32-
needs: [build-base]
33-
uses: ./.github/workflows/build-attester.yaml
34-
secrets: inherit
35-
with:
36-
push: true
37-
target: release
38-
base_image: ${{ github.sha }}
39-
40-
build-custom-issuer:
41-
needs: [build-base]
42-
uses: ./.github/workflows/build-custom-issuer.yaml
43-
secrets: inherit
44-
with:
45-
push: true
46-
target: release
47-
base_image: ${{ github.sha }}
48-
49-
deploy:
50-
needs: [build-relayer, build-attester, build-custom-issuer]
51-
uses: ./.github/workflows/deploy.yaml
52-
secrets: inherit
53-
with:
54-
environment: 'staging'
14+
build-base:
15+
uses: ./.github/workflows/build-base.yaml
16+
secrets: inherit
17+
with:
18+
push: true
19+
tag: ${{ github.sha }}
20+
21+
build-relayer:
22+
needs: [build-base]
23+
uses: ./.github/workflows/build-relayer.yaml
24+
secrets: inherit
25+
with:
26+
push: true
27+
target: release
28+
tag: ${{ github.sha }}
29+
30+
build-attester:
31+
needs: [build-base]
32+
uses: ./.github/workflows/build-attester.yaml
33+
secrets: inherit
34+
with:
35+
push: true
36+
target: release
37+
tag: ${{ github.sha }}
38+
39+
build-custom-issuer:
40+
needs: [build-base]
41+
uses: ./.github/workflows/build-custom-issuer.yaml
42+
secrets: inherit
43+
with:
44+
push: true
45+
target: release
46+
tag: ${{ github.sha }}
47+
48+
deploy:
49+
needs: [build-relayer, build-attester, build-custom-issuer]
50+
uses: ./.github/workflows/deploy.yaml
51+
secrets: inherit
52+
with:
53+
environment: 'staging'

‎.github/workflows/build-attester.yaml‎

Lines changed: 48 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,50 +9,81 @@ on:
99
target:
1010
required: true
1111
type: string
12-
base_image:
12+
tag:
1313
required: true
1414
type: string
1515

16+
permissions:
17+
# Needed to configure aws credentials step
18+
id-token: write
19+
contents: read
20+
1621
jobs:
1722
build:
1823
name: Build
1924
runs-on: ubuntu-latest
2025
timeout-minutes: 30
26+
2127
steps:
22-
# Checkout repository under $GITHUB_WORKSPACE path
28+
- name: Shorten SHA TAG
29+
id: env-vars
30+
shell: bash
31+
env:
32+
FULL_SHA: ${{ inputs.tag }}
33+
run: echo "TAG=${FULL_SHA::16}" >> $GITHUB_OUTPUT
34+
2335
- name: Repository checkout
2436
uses: actions/checkout@v4
37+
38+
- name: Configure AWS credentials
39+
uses: aws-actions/configure-aws-credentials@v4
2540
with:
26-
fetch-depth: 0
41+
role-to-assume: arn:aws:iam::291847425310:role/gitHubDeploymentsRoleFastAuth
42+
role-session-name: deploymentsRoleFastAuth
43+
role-duration-seconds: 900
44+
aws-region: us-east-1
2745

28-
- name: Set up QEMU
29-
uses: docker/setup-qemu-action@v3
46+
- name: Login to ECR
47+
uses: aws-actions/amazon-ecr-login@v2
3048

3149
- name: Set up Docker Buildx
3250
uses: docker/setup-buildx-action@v3
3351

34-
- name: Login to DockerHub
35-
uses: docker/login-action@v3
52+
# Restore local cache
53+
- name: Restore cache
54+
uses: actions/cache@v3
3655
with:
37-
username: ${{ secrets.DOCKER_USERNAME }}
38-
password: ${{ secrets.DOCKER_PUSH_TOKEN }}
39-
40-
# Configure tag name
41-
- name: Sets env vars
42-
run: |
43-
echo "DOCKER_IMAGE_NAME=${{ secrets.DOCKER_USERNAME }}/${{ github.event.repository.name }}-attester:${GITHUB_SHA:0:8}" >> $GITHUB_ENV
56+
path: /tmp/.buildx-cache
57+
key: ${{ github.job }}-${{ runner.os }}-buildx-attester
58+
restore-keys: |
59+
${{ github.job }}-${{ runner.os }}-buildx-attester
4460
4561
# Build docker image
4662
- name: Build docker image
47-
uses: docker/build-push-action@v4
63+
uses: docker/build-push-action@v5
64+
env:
65+
TAG: ${{ steps.env-vars.outputs.TAG }}
4866
with:
4967
context: .
5068
file: docker/attester.Dockerfile
69+
provenance: false
5170
target: ${{ inputs.target }}
5271
push: ${{ inputs.push }}
53-
tags: ${{ env.DOCKER_IMAGE_NAME }}
72+
tags: |
73+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/attester:${{ env.TAG }}
74+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/attester:latest
75+
outputs: type=image
76+
cache-from: type=local,src=/tmp/.buildx-cache
77+
cache-to: type=local,dest=/tmp/.buildx-cache-new
5478
build-args: |
55-
BASE_IMAGE=ghcr.io/peersyst/${{ github.event.repository.name }}-base:${{ inputs.base_image }}
79+
BASE_IMAGE=291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/base:${{ env.TAG }}
5680
TURBO_TEAM=peersyst
5781
secrets: |
5882
turbo_token=${{ secrets.TURBO_TOKEN }}
83+
84+
# Save latest cache
85+
- name: Save cache
86+
if: always()
87+
run: |
88+
rm -rf /tmp/.buildx-cache
89+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache

‎.github/workflows/build-base.yaml‎

Lines changed: 53 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -10,40 +10,75 @@ on:
1010
required: true
1111
type: string
1212

13+
permissions:
14+
# Needed to configure aws credentials step
15+
id-token: write
16+
contents: read
17+
1318
jobs:
1419
build:
1520
name: Build
1621
runs-on: ubuntu-latest
1722
timeout-minutes: 30
23+
1824
steps:
19-
# Checkout repository under $GITHUB_WORKSPACE path
25+
- name: Shorten SHA TAG
26+
id: env-vars
27+
shell: bash
28+
env:
29+
FULL_SHA: ${{ inputs.tag }}
30+
run: echo "TAG=${FULL_SHA::16}" >> $GITHUB_OUTPUT
31+
2032
- name: Repository checkout
2133
uses: actions/checkout@v4
34+
35+
- name: Configure AWS credentials
36+
uses: aws-actions/configure-aws-credentials@v4
2237
with:
23-
fetch-depth: 0
38+
role-to-assume: arn:aws:iam::291847425310:role/gitHubDeploymentsRoleFastAuth
39+
role-session-name: deploymentsRoleFastAuth
40+
role-duration-seconds: 900
41+
aws-region: us-east-1
2442

25-
- name: Set up QEMU
26-
uses: docker/setup-qemu-action@v3
43+
- name: Login to ECR
44+
uses: aws-actions/amazon-ecr-login@v2
2745

2846
- name: Set up Docker Buildx
2947
uses: docker/setup-buildx-action@v3
3048

31-
- name: Login to DockerHub
32-
uses: docker/login-action@v3
49+
# Restore local cache
50+
- name: Restore cache
51+
uses: actions/cache@v3
3352
with:
34-
registry: ghcr.io
35-
username: ${{ github.repository_owner }}
36-
password: ${{ secrets.GITHUB_TOKEN }}
53+
path: /tmp/.buildx-cache
54+
key: ${{ github.job }}-${{ runner.os }}-buildx-base
55+
restore-keys: |
56+
${{ github.job }}-${{ runner.os }}-buildx-base
3757
3858
# Build docker image
3959
- name: Build docker image
40-
uses: docker/build-push-action@v4
60+
uses: docker/build-push-action@v5
61+
env:
62+
TAG: ${{ steps.env-vars.outputs.TAG }}
4163
with:
42-
context: .
43-
file: docker/base.Dockerfile
44-
push: ${{ inputs.push }}
45-
tags: ghcr.io/peersyst/${{ github.event.repository.name }}-base:${{ inputs.tag }}
46-
build-args: |
47-
TURBO_TEAM=peersyst
48-
secrets: |
49-
turbo_token=${{ secrets.TURBO_TOKEN }}
64+
context: .
65+
file: docker/base.Dockerfile
66+
provenance: false
67+
push: ${{ inputs.push }}
68+
tags: |
69+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/base:${{ env.TAG }}
70+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/base:latest
71+
outputs: type=image
72+
cache-from: type=local,src=/tmp/.buildx-cache
73+
cache-to: type=local,dest=/tmp/.buildx-cache-new
74+
build-args: |
75+
TURBO_TEAM=peersyst
76+
secrets: |
77+
turbo_token=${{ secrets.TURBO_TOKEN }}
78+
79+
# Save latest cache
80+
- name: Save cache
81+
if: always()
82+
run: |
83+
rm -rf /tmp/.buildx-cache
84+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache

‎.github/workflows/build-custom-issuer.yaml‎

Lines changed: 47 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,51 +9,80 @@ on:
99
target:
1010
required: true
1111
type: string
12-
base_image:
12+
tag:
1313
required: true
1414
type: string
15+
permissions:
16+
# Needed to configure aws credentials step
17+
id-token: write
18+
contents: read
1519

1620
jobs:
1721
build:
1822
name: Build
1923
runs-on: ubuntu-latest
2024
timeout-minutes: 30
25+
2126
steps:
22-
# Checkout repository under $GITHUB_WORKSPACE path
27+
- name: Shorten SHA TAG
28+
id: env-vars
29+
shell: bash
30+
env:
31+
FULL_SHA: ${{ inputs.tag }}
32+
run: echo "TAG=${FULL_SHA::16}" >> $GITHUB_OUTPUT
33+
2334
- name: Repository checkout
2435
uses: actions/checkout@v4
36+
37+
- name: Configure AWS credentials
38+
uses: aws-actions/configure-aws-credentials@v4
2539
with:
26-
fetch-depth: 0
40+
role-to-assume: arn:aws:iam::291847425310:role/gitHubDeploymentsRoleFastAuth
41+
role-session-name: deploymentsRoleFastAuth
42+
role-duration-seconds: 900
43+
aws-region: us-east-1
2744

28-
- name: Set up QEMU
29-
uses: docker/setup-qemu-action@v3
45+
- name: Login to ECR
46+
uses: aws-actions/amazon-ecr-login@v2
3047

3148
- name: Set up Docker Buildx
3249
uses: docker/setup-buildx-action@v3
3350

34-
- name: Login to DockerHub
35-
uses: docker/login-action@v3
51+
# Restore local cache
52+
- name: Restore cache
53+
uses: actions/cache@v3
3654
with:
37-
registry: ghcr.io
38-
username: ${{ github.repository_owner }}
39-
password: ${{ secrets.GITHUB_TOKEN }}
40-
41-
# Configure tag name
42-
- name: Sets env vars
43-
run: |
44-
echo "DOCKER_IMAGE_NAME=ghcr.io/peersyst/${{ github.event.repository.name }}-custom-issuer:${GITHUB_SHA:0:8}" >> $GITHUB_ENV
55+
path: /tmp/.buildx-cache
56+
key: ${{ github.job }}-${{ runner.os }}-buildx-custom-issuer
57+
restore-keys: |
58+
${{ github.job }}-${{ runner.os }}-buildx-custom-issuer
4559
4660
# Build docker image
4761
- name: Build docker image
48-
uses: docker/build-push-action@v4
62+
uses: docker/build-push-action@v5
63+
env:
64+
TAG: ${{ steps.env-vars.outputs.TAG }}
4965
with:
5066
context: .
5167
file: docker/custom-issuer.Dockerfile
68+
provenance: false
5269
target: ${{ inputs.target }}
5370
push: ${{ inputs.push }}
54-
tags: ${{ env.DOCKER_IMAGE_NAME }}
71+
tags: |
72+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/custom-issuer:${{ env.TAG }}
73+
291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/custom-issuer:latest
74+
outputs: type=image
75+
cache-from: type=local,src=/tmp/.buildx-cache
76+
cache-to: type=local,dest=/tmp/.buildx-cache-new
5577
build-args: |
56-
BASE_IMAGE=ghcr.io/peersyst/${{ github.event.repository.name }}-base:${{ inputs.base_image }}
78+
BASE_IMAGE=291847425310.dkr.ecr.us-east-1.amazonaws.com/fast-auth/base:${{ env.TAG }}
5779
TURBO_TEAM=peersyst
5880
secrets: |
5981
turbo_token=${{ secrets.TURBO_TOKEN }}
82+
83+
# Save latest cache
84+
- name: Save cache
85+
if: always()
86+
run: |
87+
rm -rf /tmp/.buildx-cache
88+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache

0 commit comments

Comments
 (0)