public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Update ECR repository creation to enable image scanning on push

This commit is contained in:
Sailinder 2026-08-12 12:24:02 +02:00
parent 846a7e68a6
commit d2e3642a54
No known key found for this signature in database
GPG Key ID: 1CBD752C60D8B536
1 changed files with 57 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
.github/workflows/publish.yaml vendored
View File

@ -1,55 +1,57 @@
name: Publish name: Publish
on: on:
release: release:
types: [published] types: [published]
permissions: permissions:
id-token: write id-token: write
contents: read contents: read
env: env:
AWS_REGION: us-east-1 AWS_REGION: us-east-1
ECR_REPOSITORY: reporting/oauth2-proxy ECR_REPOSITORY: reporting/oauth2-proxy
jobs: jobs:
Publish: Publish:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
name: Publish to Amazon ECR name: Publish to Amazon ECR
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: Configure AWS credentials - name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0 uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
with: with:
role-to-assume: ${{ secrets.PICS_ECR_ROLE_ARN }} role-to-assume: ${{ secrets.PICS_ECR_ROLE_ARN }}
aws-region: ${{ env.AWS_REGION }} aws-region: ${{ env.AWS_REGION }}
- name: Login to Amazon ECR - name: Login to Amazon ECR
id: login-ecr id: login-ecr
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
- name: Create ECR repository (if it does not exist)
aws ecr create-repository \ run: |
--repository-name "${ECR_REPOSITORY}" \ aws ecr create-repository \
--image-scanning-configuration scanOnPush=true \ --repository-name "${ECR_REPOSITORY}" \
>/dev/null 2>&1 || aws ecr describe-repositories --repository-names "${ECR_REPOSITORY}" >/dev/null --image-scanning-configuration scanOnPush=false \
>/dev/null 2>&1 || aws ecr describe-repositories --repository-names "${ECR_REPOSITORY}" >/dev/null
- name: Enforce image tag immutability
run: |
aws ecr put-image-tag-mutability \ - name: Enforce image tag immutability
--repository-name "${ECR_REPOSITORY}" \ run: |
--image-tag-mutability IMMUTABLE aws ecr put-image-tag-mutability \
--repository-name "${ECR_REPOSITORY}" \
- name: Apply ECR delete-protection policy --image-tag-mutability IMMUTABLE
run: |
aws ecr set-repository-policy \ - name: Apply ECR delete-protection policy
--repository-name "${ECR_REPOSITORY}" \ run: |
--policy-text '{"Version":"2012-10-17","Statement":[{"Sid":"DenyDeleteRepository","Effect":"Deny","Principal":"*","Action":"ecr:DeleteRepository"}]}' aws ecr set-repository-policy \
--repository-name "${ECR_REPOSITORY}" \
- name: Publish Docker image --policy-text '{"Version":"2012-10-17","Statement":[{"Sid":"DenyDeleteRepository","Effect":"Deny","Principal":"*","Action":"ecr:DeleteRepository"}]}'
uses: docker/build-push-action@v4
with: - name: Publish Docker image
context: ${{ github.workspace }} uses: docker/build-push-action@v4
push: true with:
tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }} context: ${{ github.workspace }}
push: true
tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.release.tag_name }}