From 5ceaa39f987849a20a681486fef4d4421588ae41 Mon Sep 17 00:00:00 2001 From: Sailinder Harpal Date: Wed, 12 Aug 2026 12:07:00 +0200 Subject: [PATCH 1/3] Change Docker publish workflow to use Amazon ECR Updated the workflow to publish Docker images to Amazon ECR instead of a Docker repository. Added AWS credentials configuration, ECR repository creation, and image tag immutability enforcement. --- .github/workflows/publish.yaml | 45 ++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 6d78c2a6..f2b9b3eb 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -4,25 +4,54 @@ on: release: types: [published] +permissions: + id-token: write + contents: read + +env: + AWS_REGION: us-east-1 + ECR_REPOSITORY: reporting/oauth2-proxy + jobs: Publish: runs-on: ubuntu-22.04 - name: Publish to docker repository + name: Publish to Amazon ECR steps: - name: Checkout uses: actions/checkout@v4 - - name: Docker registry login - uses: docker/login-action@v3.0.0 + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0 with: - registry: docker.eu1.hsdp.io - username: ${{ secrets.PICS_DOCKER_USER }} - password: ${{ secrets.PICS_DOCKER_PASSWORD }} - logout: true + role-to-assume: ${{ secrets.PICS_ECR_ROLE_ARN }} + aws-region: ${{ env.AWS_REGION }} + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 + + - name: Create ECR repository (if it does not exist) + run: | + aws ecr create-repository \ + --repository-name "${ECR_REPOSITORY}" \ + --image-scanning-configuration scanOnPush=true \ + 2>/dev/null || true + + - name: Enforce image tag immutability + run: | + aws ecr put-image-tag-mutability \ + --repository-name "${ECR_REPOSITORY}" \ + --image-tag-mutability IMMUTABLE + + - name: Apply ECR delete-protection policy + run: | + aws ecr set-repository-policy \ + --repository-name "${ECR_REPOSITORY}" \ + --policy-text '{"Version":"2012-10-17","Statement":[{"Sid":"DenyDeleteRepository","Effect":"Deny","Principal":"*","Action":"ecr:DeleteRepository"}]}' - name: Publish Docker image uses: docker/build-push-action@v4 with: context: ${{ github.workspace }} push: true - tags: docker.eu1.hsdp.io/reporting/oauth2-proxy:${{ github.event.release.tag_name }} + tags: ${{ secrets.PICS_ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }} From 846a7e68a6ea6bc2233551ad42e99032d1050e79 Mon Sep 17 00:00:00 2001 From: Sailinder Harpal Date: Wed, 12 Aug 2026 12:18:56 +0200 Subject: [PATCH 2/3] Apply suggestions from code review Good comments. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/publish.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index f2b9b3eb..e7e90065 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -30,12 +30,10 @@ jobs: id: login-ecr uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 - - name: Create ECR repository (if it does not exist) - run: | - aws ecr create-repository \ - --repository-name "${ECR_REPOSITORY}" \ - --image-scanning-configuration scanOnPush=true \ - 2>/dev/null || true +aws ecr create-repository \ + --repository-name "${ECR_REPOSITORY}" \ + --image-scanning-configuration scanOnPush=true \ + >/dev/null 2>&1 || aws ecr describe-repositories --repository-names "${ECR_REPOSITORY}" >/dev/null - name: Enforce image tag immutability run: | @@ -54,4 +52,4 @@ jobs: with: context: ${{ github.workspace }} push: true - tags: ${{ secrets.PICS_ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }} +tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }} From d2e3642a547351aaacf09d8a8eaf3f4b2746792e Mon Sep 17 00:00:00 2001 From: Sailinder Date: Wed, 12 Aug 2026 12:24:02 +0200 Subject: [PATCH 3/3] Update ECR repository creation to enable image scanning on push --- .github/workflows/publish.yaml | 112 +++++++++++++++++---------------- 1 file changed, 57 insertions(+), 55 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index e7e90065..1a90608a 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -1,55 +1,57 @@ -name: Publish - -on: - release: - types: [published] - -permissions: - id-token: write - contents: read - -env: - AWS_REGION: us-east-1 - ECR_REPOSITORY: reporting/oauth2-proxy - -jobs: - Publish: - runs-on: ubuntu-22.04 - name: Publish to Amazon ECR - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0 - with: - role-to-assume: ${{ secrets.PICS_ECR_ROLE_ARN }} - aws-region: ${{ env.AWS_REGION }} - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 - -aws ecr create-repository \ - --repository-name "${ECR_REPOSITORY}" \ - --image-scanning-configuration scanOnPush=true \ - >/dev/null 2>&1 || aws ecr describe-repositories --repository-names "${ECR_REPOSITORY}" >/dev/null - - - name: Enforce image tag immutability - run: | - aws ecr put-image-tag-mutability \ - --repository-name "${ECR_REPOSITORY}" \ - --image-tag-mutability IMMUTABLE - - - name: Apply ECR delete-protection policy - run: | - aws ecr set-repository-policy \ - --repository-name "${ECR_REPOSITORY}" \ - --policy-text '{"Version":"2012-10-17","Statement":[{"Sid":"DenyDeleteRepository","Effect":"Deny","Principal":"*","Action":"ecr:DeleteRepository"}]}' - - - name: Publish Docker image - uses: docker/build-push-action@v4 - with: - context: ${{ github.workspace }} - push: true -tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }} +name: Publish + +on: + release: + types: [published] + +permissions: + id-token: write + contents: read + +env: + AWS_REGION: us-east-1 + ECR_REPOSITORY: reporting/oauth2-proxy + +jobs: + Publish: + runs-on: ubuntu-22.04 + name: Publish to Amazon ECR + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0 + with: + role-to-assume: ${{ secrets.PICS_ECR_ROLE_ARN }} + aws-region: ${{ env.AWS_REGION }} + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 + - name: Create ECR repository (if it does not exist) + run: | + aws ecr create-repository \ + --repository-name "${ECR_REPOSITORY}" \ + --image-scanning-configuration scanOnPush=false \ + >/dev/null 2>&1 || aws ecr describe-repositories --repository-names "${ECR_REPOSITORY}" >/dev/null + + + - name: Enforce image tag immutability + run: | + aws ecr put-image-tag-mutability \ + --repository-name "${ECR_REPOSITORY}" \ + --image-tag-mutability IMMUTABLE + + - name: Apply ECR delete-protection policy + run: | + aws ecr set-repository-policy \ + --repository-name "${ECR_REPOSITORY}" \ + --policy-text '{"Version":"2012-10-17","Statement":[{"Sid":"DenyDeleteRepository","Effect":"Deny","Principal":"*","Action":"ecr:DeleteRepository"}]}' + + - name: Publish Docker image + uses: docker/build-push-action@v4 + with: + context: ${{ github.workspace }} + push: true + tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }}