hasura-auth/.github/workflows/wf_docker_push_image.yaml at d7140d11197e7fab311ae6e35f941a9d3d7b821f · nhost/hasura-auth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
---
on:
  workflow_call:
    inputs:
      NAME:
        type: string
        required: true
      VERSION:
        type: string
        required: true
      AWS_REGION:
        type: string
        required: true

    secrets:
      AWS_ACCOUNT_ID:
        required: true
      DOCKER_USERNAME:
        required: true
      DOCKER_PASSWORD:
        required: true

jobs:
  push-to-ecr:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    permissions:
      id-token: write
      contents: write

    steps:
      - name: "Check out repository"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: true

      - name: "Compute common env vars"
        id: vars
        run: |
          echo "VERSION=$(make get-version VER=${{ inputs.VERSION }})" >> $GITHUB_OUTPUT

      - name: "Configure aws"
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-nhost-${{ github.event.repository.name }}
          aws-region: eu-central-1

      - name: "Login to Amazon ECR"
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: 'true'

      - name: "Get artifacts"
        uses: actions/download-artifact@v5
        with:
          path: ~/artifacts

      - name: "Inspect artifacts"
        run: find ~/artifacts

      - name: "Push docker image to EKS"
        run: |
          export NAME=${{ inputs.NAME }}
          export VERSION=${{ steps.vars.outputs.VERSION }}
          export CONTAINER_REGISTRY=${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ inputs.AWS_REGION }}.amazonaws.com
          export CONTAINER_NAME=$CONTAINER_REGISTRY/$NAME

          for ARCH in "x86_64" "aarch64"; do
            skopeo copy --insecure-policy \
              dir:/home/runner/artifacts/${{ inputs.NAME }}-docker-image-$ARCH-$VERSION \
              docker-daemon:$CONTAINER_NAME:$VERSION-$ARCH
            docker push $CONTAINER_NAME:$VERSION-$ARCH
          done

          docker manifest create \
            $CONTAINER_NAME:$VERSION \
            --amend $CONTAINER_NAME:$VERSION-x86_64 \
            --amend $CONTAINER_NAME:$VERSION-aarch64

          docker manifest push $CONTAINER_NAME:$VERSION

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: "Push docker image to docker hub"
        run: |
          export NAME=${{ inputs.NAME }}
          export VERSION=${{ steps.vars.outputs.VERSION }}
          export CONTAINER_REGISTRY=nhost
          export CONTAINER_NAME=$CONTAINER_REGISTRY/$NAME

          for ARCH in "x86_64" "aarch64"; do
            skopeo copy --insecure-policy \
              dir:/home/runner/artifacts/${{ inputs.NAME }}-docker-image-$ARCH-$VERSION \
              docker-daemon:$CONTAINER_NAME:$VERSION-$ARCH
            docker push $CONTAINER_NAME:$VERSION-$ARCH
          done

          docker manifest create \
            $CONTAINER_NAME:$VERSION \
            --amend $CONTAINER_NAME:$VERSION-x86_64 \
            --amend $CONTAINER_NAME:$VERSION-aarch64

          docker manifest push $CONTAINER_NAME:$VERSION