action.yaml

name: "Upload Containers to ECR, update references in CF templates"
description: "Packages and uploads, replaces reference in (eg) template.yaml"
inputs:

  role-to-assume-arn:
    description: "The secret with the ARN of the role to assume (required) eg secrets.GH_ACTIONS_ROLE_ARN"
    required: true
  container-sign-kms-key-arn:
    description: "The secret with the ARN of the key to sign container images e.g. secrets.CONTAINER_SIGN_KMS_KEY"
    required: true
  template-file:
    description: "The name of the CF template for the application. This defaults to template.yaml"
    required: false
    default: template.yaml
  working-directory:
    description: "The working directory containing the app"
    required: false
  artifact-bucket-name:
    description: "The secret with the name of the artifact S3 bucket (required) eg secrets.ARTIFACT_SOURCE_BUCKET_NAME"
    required: true
  ecr-repo-name:
    description: "The secret with the name of the ECR Repo (required) eg secrets.ECR_REPOSITORY"
    required: true

runs:
  using: "composite"

  steps:
    - name: Checkout repo
      uses: actions/checkout@v3

    - name: Set up Python 3.8
      uses: actions/setup-python@v4
      with:
        python-version: "3.8"

    - name: Set up AWS creds
      uses: aws-actions/configure-aws-credentials@v1-node16
      with:
        role-to-assume: ${{ inputs.role-to-assume-arn }}
        aws-region: eu-west-2

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1

    - name: Install Cosign
      uses: sigstore/cosign-installer@main
      with:
        cosign-release: 'v1.9.0'

    - name: Upload Fargates to S3
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        CONTAINER_SIGN_KMS_KEY_ARN: ${{ inputs.container-sign-kms-key-arn }}
        GITHUB_SHA: ${{ github.sha }}
        WORKING_DIRECTORY: ${{ inputs.working-directory }}
        TEMPLATE_FILE: ${{ inputs.template-file }}
        ECR_REPO_NAME: ${{ inputs.ecr-repo-name }}
        ARTIFACT_BUCKET_NAME: ${{ inputs.artifact-bucket-name }}

      run: ${{ github.action_path }}/scripts/build-tag-push-ecr.sh
      shell: bash