From e0a90bf224d4e898e13694282df9489c81382f09 Mon Sep 17 00:00:00 2001 From: chainchad <96362174+chainchad@users.noreply.github.com> Date: Thu, 1 Oct 2026 07:54:45 -0400 Subject: [PATCH] Use GATI v2 via the new `gati-profile` input for the docker build/publish workflow --- .../reusable-docker-build-publish-gati-v2.md | 8 +++ .../reusable-docker-build-publish.yml | 50 +++++++------------ .../reusable-docker-build-publish/README.md | 28 +++++------ .../reusable-docker-build-publish.yml | 50 +++++++------------ 4 files changed, 60 insertions(+), 76 deletions(-) create mode 100644 .changeset/reusable-docker-build-publish-gati-v2.md diff --git a/.changeset/reusable-docker-build-publish-gati-v2.md b/.changeset/reusable-docker-build-publish-gati-v2.md new file mode 100644 index 000000000..653ecb10a --- /dev/null +++ b/.changeset/reusable-docker-build-publish-gati-v2.md @@ -0,0 +1,8 @@ +--- +"reusable-docker-build-publish": major +--- + +feat: use GATI v2 via the new `gati-profile` input + +BREAKING: remove the `AWS_ROLE_GATI_ARN` and `AWS_LAMBDA_GATI_URL` secrets and +the `aws-region-gati` input. Set `gati-profile` to a GATI v2 profile instead. diff --git a/.github/workflows/reusable-docker-build-publish.yml b/.github/workflows/reusable-docker-build-publish.yml index 8a7485153..f1813a3d2 100644 --- a/.github/workflows/reusable-docker-build-publish.yml +++ b/.github/workflows/reusable-docker-build-publish.yml @@ -24,7 +24,7 @@ name: Reusable Docker Build and Publish # docker-build-publish: # permissions: # contents: read # needed to checkout repo. -# id-token: write # needed to assume AWS IAM role via OIDC (and Sigstore signing). +# id-token: write # needed to assume AWS IAM role via OIDC, request a GATI token, and Sigstore signing. # attestations: write # needed when docker-manifest-attestation is not "disabled". # artifact-metadata: write # needed only when docker-manifest-attestation is "github-and-registry". # uses: smartcontractkit/.github/.github/workflows/reusable-docker-build-publish.yml@ @@ -32,7 +32,7 @@ name: Reusable Docker Build and Publish # # NOTE: Remove the "\" escape character for every: $\{{ when implementing. # aws-ecr-name: chainlink # aws-region-ecr: us-east-1 -# aws-region-gati: us-west-2 +# gati-profile: my-profile # Optional: GATI v2 profile for private GitHub dependencies # dockerfile: Dockerfile # docker-build-context: . # docker-image-tag-strip-prefix: v # Optional: strip "v" prefix from tags @@ -51,8 +51,6 @@ name: Reusable Docker Build and Publish # secrets: # AWS_ACCOUNT_ID: $\{{ secrets.AWS_ACCOUNT_ID }} # AWS_ROLE_PUBLISH_ARN: $\{{ secrets.AWS_ROLE_PUBLISH_ARN }} # Remove the "\" escape character. -# AWS_ROLE_GATI_ARN: $\{{ secrets.AWS_ROLE_GATI_ARN }} # Remove the "\" escape character. -# AWS_LAMBDA_GATI_URL: $\{{ secrets.AWS_LAMBDA_GATI_URL }} # Remove the "\" escape character. # GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: $\{{ secrets.MY_FPAT_TOKEN }} # Optional: Override GitHub token ## on: @@ -64,23 +62,12 @@ on: AWS_ROLE_PUBLISH_ARN: description: "AWS OIDC role ARN used for publishing to AWS ECR." required: true - AWS_ROLE_GATI_ARN: - description: | - AWS OIDC role ARN used for getting token from GATI. - - Use this and AWS_LAMBDA_GATI_URL if building a Docker image with private GitHub repo dependencies. - - The token will be mounted as a secret within the Docker build context. - required: false - AWS_LAMBDA_GATI_URL: - description: "AWS Lambda URL for GATI." - required: false GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: description: | Override the GitHub token mounted as a secret for Docker builds. - If not specified, we will try and use GATI for GitHub auth if its - required secrets are provided. + If not specified, we will try and use GATI for GitHub auth if + inputs.gati-profile is provided. This can be used to provide a FPAT (fine-grained personal access token) for accessing private repositories during Docker builds. @@ -101,8 +88,13 @@ on: description: "AWS region for AWS ECR." required: true type: string - aws-region-gati: - description: "AWS region for GATI (GitHub Actions Token Issuer)." + gati-profile: + description: | + GATI v2 (GitHub Actions Token Issuer) profile used to request a GitHub token. + + Use this if building a Docker image with private GitHub repo dependencies. + + The token will be mounted as a secret within the Docker build context. required: false type: string set-git-config-gati: @@ -743,27 +735,23 @@ jobs: - name: Check for GATI id: check-gati env: - AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }} - AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }} + GATI_PROFILE: ${{ inputs.gati-profile }} GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }} run: | - if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then - if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then - echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" - fi + if [[ -n "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then + echo "Skipping GATI because secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is set." + elif [[ -z "${GATI_PROFILE}" ]]; then + echo "Skipping GATI because inputs.gati-profile is not set." else - echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set." + echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" fi - name: Setup GitHub token using GATI if: steps.check-gati.outputs.use-gati == 'true' id: token - uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0 + uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1 with: - aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }} - aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }} - aws-region: ${{ inputs.aws-region-gati }} - aws-role-duration-seconds: "1800" + profile: ${{ inputs.gati-profile }} set-git-config: ${{ inputs.set-git-config-gati }} - name: Run custom pre-build commands diff --git a/workflows/reusable-docker-build-publish/README.md b/workflows/reusable-docker-build-publish/README.md index 74322937e..52d3b755c 100644 --- a/workflows/reusable-docker-build-publish/README.md +++ b/workflows/reusable-docker-build-publish/README.md @@ -40,7 +40,7 @@ At minimum: ```yaml permissions: contents: read # checkout - id-token: write # OIDC to assume AWS role(s) + id-token: write # OIDC to assume AWS role(s) and request a GATI token ``` When `docker-manifest-attestation` is not `"disabled"`, the calling job must @@ -143,16 +143,17 @@ Set the secret: This token will be passed to the Docker build action as the token secret. -### Option B: Use GATI (GitHub Actions Token Issuer) +### Option B: Use GATI v2 (GitHub Actions Token Issuer) -If all of the following are provided: +If `inputs.gati-profile` is set (and you did **not** set +`GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE`), the workflow will fetch a token from GATI +v2 via the `setup-github-token` action and use it for the build. -- `secrets.AWS_ROLE_GATI_ARN` -- `secrets.AWS_LAMBDA_GATI_URL` -- (and you did **not** set `GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE`) - -…the workflow will fetch a token via the `setup-github-token` action and use it -for the build. +```yaml +with: + gati-profile: my-profile + # ...other required inputs... +``` Optional helper: @@ -292,6 +293,10 @@ Controlled by `docker-cache-behaviour`: - `timeout` — job timeout minutes (default `30`) - `free-disk-space` (`"true"`/`"false"`) — attempt to free disk before build - `github-runner-amd64`, `github-runner-arm64` — runner labels +- `gati-profile` — GATI v2 profile used to fetch a GitHub token for private + dependencies (see Authentication above) +- `set-git-config-gati` (`"true"`/`"false"`, default `"false"`) — configure git + to use the GATI token --- @@ -302,11 +307,6 @@ Controlled by `docker-cache-behaviour`: - `AWS_ACCOUNT_ID` — AWS account id for ECR - `AWS_ROLE_PUBLISH_ARN` — OIDC role ARN used to publish to ECR -### Optional (for GATI) - -- `AWS_ROLE_GATI_ARN` -- `AWS_LAMBDA_GATI_URL` - ### Optional (token override) - `GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE` diff --git a/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml b/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml index 45be8d2cb..04fa9558a 100644 --- a/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml +++ b/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml @@ -20,7 +20,7 @@ name: Reusable Docker Build and Publish # docker-build-publish: # permissions: # contents: read # needed to checkout repo. -# id-token: write # needed to assume AWS IAM role via OIDC (and Sigstore signing). +# id-token: write # needed to assume AWS IAM role via OIDC, request a GATI token, and Sigstore signing. # attestations: write # needed when docker-manifest-attestation is not "disabled". # artifact-metadata: write # needed only when docker-manifest-attestation is "github-and-registry". # uses: smartcontractkit/.github/.github/workflows/reusable-docker-build-publish.yml@ @@ -28,7 +28,7 @@ name: Reusable Docker Build and Publish # # NOTE: Remove the "\" escape character for every: $\{{ when implementing. # aws-ecr-name: chainlink # aws-region-ecr: us-east-1 -# aws-region-gati: us-west-2 +# gati-profile: my-profile # Optional: GATI v2 profile for private GitHub dependencies # dockerfile: Dockerfile # docker-build-context: . # docker-image-tag-strip-prefix: v # Optional: strip "v" prefix from tags @@ -47,8 +47,6 @@ name: Reusable Docker Build and Publish # secrets: # AWS_ACCOUNT_ID: $\{{ secrets.AWS_ACCOUNT_ID }} # AWS_ROLE_PUBLISH_ARN: $\{{ secrets.AWS_ROLE_PUBLISH_ARN }} # Remove the "\" escape character. -# AWS_ROLE_GATI_ARN: $\{{ secrets.AWS_ROLE_GATI_ARN }} # Remove the "\" escape character. -# AWS_LAMBDA_GATI_URL: $\{{ secrets.AWS_LAMBDA_GATI_URL }} # Remove the "\" escape character. # GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: $\{{ secrets.MY_FPAT_TOKEN }} # Optional: Override GitHub token ## on: @@ -60,23 +58,12 @@ on: AWS_ROLE_PUBLISH_ARN: description: "AWS OIDC role ARN used for publishing to AWS ECR." required: true - AWS_ROLE_GATI_ARN: - description: | - AWS OIDC role ARN used for getting token from GATI. - - Use this and AWS_LAMBDA_GATI_URL if building a Docker image with private GitHub repo dependencies. - - The token will be mounted as a secret within the Docker build context. - required: false - AWS_LAMBDA_GATI_URL: - description: "AWS Lambda URL for GATI." - required: false GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: description: | Override the GitHub token mounted as a secret for Docker builds. - If not specified, we will try and use GATI for GitHub auth if its - required secrets are provided. + If not specified, we will try and use GATI for GitHub auth if + inputs.gati-profile is provided. This can be used to provide a FPAT (fine-grained personal access token) for accessing private repositories during Docker builds. @@ -97,8 +84,13 @@ on: description: "AWS region for AWS ECR." required: true type: string - aws-region-gati: - description: "AWS region for GATI (GitHub Actions Token Issuer)." + gati-profile: + description: | + GATI v2 (GitHub Actions Token Issuer) profile used to request a GitHub token. + + Use this if building a Docker image with private GitHub repo dependencies. + + The token will be mounted as a secret within the Docker build context. required: false type: string set-git-config-gati: @@ -739,27 +731,23 @@ jobs: - name: Check for GATI id: check-gati env: - AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }} - AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }} + GATI_PROFILE: ${{ inputs.gati-profile }} GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }} run: | - if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then - if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then - echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" - fi + if [[ -n "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then + echo "Skipping GATI because secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is set." + elif [[ -z "${GATI_PROFILE}" ]]; then + echo "Skipping GATI because inputs.gati-profile is not set." else - echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set." + echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" fi - name: Setup GitHub token using GATI if: steps.check-gati.outputs.use-gati == 'true' id: token - uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0 + uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1 with: - aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }} - aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }} - aws-region: ${{ inputs.aws-region-gati }} - aws-role-duration-seconds: "1800" + profile: ${{ inputs.gati-profile }} set-git-config: ${{ inputs.set-git-config-gati }} - name: Run custom pre-build commands