eps-cdk-utils/.github/workflows/docker_image_upload.yml at main · NHSDigital/eps-cdk-utils · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: docker image upload

on:
  workflow_call:
    inputs:
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      AWS_ENVIRONMENT:
        required: true
        type: string
      TAG_LATEST:
        required: true
        type: boolean
      DOCKER_IMAGE_TAG:
        required: true
        type: string
      pinned_image:
        type: string
        required: true
    secrets:
      CDK_PUSH_IMAGE_ROLE:
        required: true

jobs:
  upload_docker_image:
    runs-on: ubuntu-22.04
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    environment: ${{ inputs.AWS_ENVIRONMENT }}
    permissions:
      id-token: write
      contents: write

    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout local github actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0
          sparse-checkout: |
            .github

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.CDK_PUSH_IMAGE_ROLE }}
          role-session-name: upload-cdk-utils-build

      - name: docker_artifact download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: docker_artifact
          path: .

      - name: Extract cdk-utils-build docker image
        id: extract-cdk-utils-build-image
        run: |
          docker load -i cdk-utils-build.img

      - name: Retrieve AWS Account ID
        id: retrieve-account-id
        run: echo "ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_ENV"

      - name: Login to Amazon ECR
        id: login-ecr
        run: |
          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com

      - name: Push tagged version cdk-utils-build to Amazon ECR
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          DOCKER_IMAGE_TAG: ${{ inputs.DOCKER_IMAGE_TAG }}
        run: |
          docker tag "cdk-utils-build:${VERSION_NUMBER}" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:${DOCKER_IMAGE_TAG}"
          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:${DOCKER_IMAGE_TAG}"

      - name: Push latest cdk-utils-build to Amazon ECR
        if: ${{ inputs.TAG_LATEST == true }}
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
        run: |
          docker tag "cdk-utils-build:${VERSION_NUMBER}" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:latest"
          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:latest"