Skip to content

Use GATI v2 via the new gati-profile input for the docker build/publish workflow #1677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
chainchad wants to merge 1 commit into from
Closed

Use GATI v2 via the new gati-profile input for the docker build/publish workflow #1677

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .changeset/reusable-docker-build-publish-gati-v2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
---
"reusable-docker-build-publish": major
---

feat: use GATI v2 via the new `gati-profile` input

BREAKING: remove the `AWS_ROLE_GATI_ARN` and `AWS_LAMBDA_GATI_URL` secrets and
the `aws-region-gati` input. Set `gati-profile` to a GATI v2 profile instead.
50 changes: 19 additions & 31 deletions .github/workflows/reusable-docker-build-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,15 @@ name: Reusable Docker Build and Publish
# docker-build-publish:
# permissions:
# contents: read # needed to checkout repo.
# id-token: write # needed to assume AWS IAM role via OIDC (and Sigstore signing).
# id-token: write # needed to assume AWS IAM role via OIDC, request a GATI token, and Sigstore signing.
# attestations: write # needed when docker-manifest-attestation is not "disabled".
# artifact-metadata: write # needed only when docker-manifest-attestation is "github-and-registry".
# uses: smartcontractkit/.github/.github/workflows/reusable-docker-build-publish.yml@<git-sha>
# with:
# # NOTE: Remove the "\" escape character for every: $\{{ when implementing.
# aws-ecr-name: chainlink
# aws-region-ecr: us-east-1
# aws-region-gati: us-west-2
# gati-profile: my-profile # Optional: GATI v2 profile for private GitHub dependencies
# dockerfile: Dockerfile
# docker-build-context: .
# docker-image-tag-strip-prefix: v # Optional: strip "v" prefix from tags
Expand All @@ -51,8 +51,6 @@ name: Reusable Docker Build and Publish
# secrets:
# AWS_ACCOUNT_ID: $\{{ secrets.AWS_ACCOUNT_ID }}
# AWS_ROLE_PUBLISH_ARN: $\{{ secrets.AWS_ROLE_PUBLISH_ARN }} # Remove the "\" escape character.
# AWS_ROLE_GATI_ARN: $\{{ secrets.AWS_ROLE_GATI_ARN }} # Remove the "\" escape character.
# AWS_LAMBDA_GATI_URL: $\{{ secrets.AWS_LAMBDA_GATI_URL }} # Remove the "\" escape character.
# GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: $\{{ secrets.MY_FPAT_TOKEN }} # Optional: Override GitHub token
##
on:
Expand All @@ -64,23 +62,12 @@ on:
AWS_ROLE_PUBLISH_ARN:
description: "AWS OIDC role ARN used for publishing to AWS ECR."
required: true
AWS_ROLE_GATI_ARN:
description: |
AWS OIDC role ARN used for getting token from GATI.

Use this and AWS_LAMBDA_GATI_URL if building a Docker image with private GitHub repo dependencies.

The token will be mounted as a secret within the Docker build context.
required: false
AWS_LAMBDA_GATI_URL:
description: "AWS Lambda URL for GATI."
required: false
GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:
description: |
Override the GitHub token mounted as a secret for Docker builds.

If not specified, we will try and use GATI for GitHub auth if its
required secrets are provided.
If not specified, we will try and use GATI for GitHub auth if
inputs.gati-profile is provided.

This can be used to provide a FPAT (fine-grained personal access
token) for accessing private repositories during Docker builds.
Expand All @@ -101,8 +88,13 @@ on:
description: "AWS region for AWS ECR."
required: true
type: string
aws-region-gati:
description: "AWS region for GATI (GitHub Actions Token Issuer)."
gati-profile:
description: |
GATI v2 (GitHub Actions Token Issuer) profile used to request a GitHub token.

Use this if building a Docker image with private GitHub repo dependencies.

The token will be mounted as a secret within the Docker build context.
required: false
type: string
set-git-config-gati:
Expand Down Expand Up @@ -743,27 +735,23 @@ jobs:
- name: Check for GATI
id: check-gati
env:
AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }}
AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }}
GATI_PROFILE: ${{ inputs.gati-profile }}
GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }}
run: |
if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then
if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
fi
if [[ -n "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
echo "Skipping GATI because secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is set."
elif [[ -z "${GATI_PROFILE}" ]]; then
echo "Skipping GATI because inputs.gati-profile is not set."
else
echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set."
echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
fi

- name: Setup GitHub token using GATI
if: steps.check-gati.outputs.use-gati == 'true'
id: token
uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0
uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1
with:
aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }}
aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }}
aws-region: ${{ inputs.aws-region-gati }}
aws-role-duration-seconds: "1800"
profile: ${{ inputs.gati-profile }}
set-git-config: ${{ inputs.set-git-config-gati }}

- name: Run custom pre-build commands
Expand Down
28 changes: 14 additions & 14 deletions workflows/reusable-docker-build-publish/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ At minimum:
```yaml
permissions:
contents: read # checkout
id-token: write # OIDC to assume AWS role(s)
id-token: write # OIDC to assume AWS role(s) and request a GATI token
```

When `docker-manifest-attestation` is not `"disabled"`, the calling job must
Expand Down Expand Up @@ -143,16 +143,17 @@ Set the secret:

This token will be passed to the Docker build action as the token secret.

### Option B: Use GATI (GitHub Actions Token Issuer)
### Option B: Use GATI v2 (GitHub Actions Token Issuer)

If all of the following are provided:
If `inputs.gati-profile` is set (and you did **not** set
`GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE`), the workflow will fetch a token from GATI
v2 via the `setup-github-token` action and use it for the build.

- `secrets.AWS_ROLE_GATI_ARN`
- `secrets.AWS_LAMBDA_GATI_URL`
- (and you did **not** set `GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE`)

…the workflow will fetch a token via the `setup-github-token` action and use it
for the build.
```yaml
with:
gati-profile: my-profile
# ...other required inputs...
```

Optional helper:

Expand Down Expand Up @@ -292,6 +293,10 @@ Controlled by `docker-cache-behaviour`:
- `timeout` — job timeout minutes (default `30`)
- `free-disk-space` (`"true"`/`"false"`) — attempt to free disk before build
- `github-runner-amd64`, `github-runner-arm64` — runner labels
- `gati-profile` — GATI v2 profile used to fetch a GitHub token for private
dependencies (see Authentication above)
- `set-git-config-gati` (`"true"`/`"false"`, default `"false"`) — configure git
to use the GATI token

---

Expand All @@ -302,11 +307,6 @@ Controlled by `docker-cache-behaviour`:
- `AWS_ACCOUNT_ID` — AWS account id for ECR
- `AWS_ROLE_PUBLISH_ARN` — OIDC role ARN used to publish to ECR

### Optional (for GATI)

- `AWS_ROLE_GATI_ARN`
- `AWS_LAMBDA_GATI_URL`

### Optional (token override)

- `GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE`
Expand Down
50 changes: 19 additions & 31 deletions workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,15 @@ name: Reusable Docker Build and Publish
# docker-build-publish:
# permissions:
# contents: read # needed to checkout repo.
# id-token: write # needed to assume AWS IAM role via OIDC (and Sigstore signing).
# id-token: write # needed to assume AWS IAM role via OIDC, request a GATI token, and Sigstore signing.
# attestations: write # needed when docker-manifest-attestation is not "disabled".
# artifact-metadata: write # needed only when docker-manifest-attestation is "github-and-registry".
# uses: smartcontractkit/.github/.github/workflows/reusable-docker-build-publish.yml@<git-sha>
# with:
# # NOTE: Remove the "\" escape character for every: $\{{ when implementing.
# aws-ecr-name: chainlink
# aws-region-ecr: us-east-1
# aws-region-gati: us-west-2
# gati-profile: my-profile # Optional: GATI v2 profile for private GitHub dependencies
# dockerfile: Dockerfile
# docker-build-context: .
# docker-image-tag-strip-prefix: v # Optional: strip "v" prefix from tags
Expand All @@ -47,8 +47,6 @@ name: Reusable Docker Build and Publish
# secrets:
# AWS_ACCOUNT_ID: $\{{ secrets.AWS_ACCOUNT_ID }}
# AWS_ROLE_PUBLISH_ARN: $\{{ secrets.AWS_ROLE_PUBLISH_ARN }} # Remove the "\" escape character.
# AWS_ROLE_GATI_ARN: $\{{ secrets.AWS_ROLE_GATI_ARN }} # Remove the "\" escape character.
# AWS_LAMBDA_GATI_URL: $\{{ secrets.AWS_LAMBDA_GATI_URL }} # Remove the "\" escape character.
# GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: $\{{ secrets.MY_FPAT_TOKEN }} # Optional: Override GitHub token
##
on:
Expand All @@ -60,23 +58,12 @@ on:
AWS_ROLE_PUBLISH_ARN:
description: "AWS OIDC role ARN used for publishing to AWS ECR."
required: true
AWS_ROLE_GATI_ARN:
description: |
AWS OIDC role ARN used for getting token from GATI.

Use this and AWS_LAMBDA_GATI_URL if building a Docker image with private GitHub repo dependencies.

The token will be mounted as a secret within the Docker build context.
required: false
AWS_LAMBDA_GATI_URL:
description: "AWS Lambda URL for GATI."
required: false
GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:
description: |
Override the GitHub token mounted as a secret for Docker builds.

If not specified, we will try and use GATI for GitHub auth if its
required secrets are provided.
If not specified, we will try and use GATI for GitHub auth if
inputs.gati-profile is provided.

This can be used to provide a FPAT (fine-grained personal access
token) for accessing private repositories during Docker builds.
Expand All @@ -97,8 +84,13 @@ on:
description: "AWS region for AWS ECR."
required: true
type: string
aws-region-gati:
description: "AWS region for GATI (GitHub Actions Token Issuer)."
gati-profile:
description: |
GATI v2 (GitHub Actions Token Issuer) profile used to request a GitHub token.

Use this if building a Docker image with private GitHub repo dependencies.

The token will be mounted as a secret within the Docker build context.
required: false
type: string
set-git-config-gati:
Expand Down Expand Up @@ -739,27 +731,23 @@ jobs:
- name: Check for GATI
id: check-gati
env:
AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }}
AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }}
GATI_PROFILE: ${{ inputs.gati-profile }}
GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }}
run: |
if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then
if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
fi
if [[ -n "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
echo "Skipping GATI because secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is set."
elif [[ -z "${GATI_PROFILE}" ]]; then
echo "Skipping GATI because inputs.gati-profile is not set."
else
echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set."
echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
fi

- name: Setup GitHub token using GATI
if: steps.check-gati.outputs.use-gati == 'true'
id: token
uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0
uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1
with:
aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }}
aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }}
aws-region: ${{ inputs.aws-region-gati }}
aws-role-duration-seconds: "1800"
profile: ${{ inputs.gati-profile }}
set-git-config: ${{ inputs.set-git-config-gati }}

- name: Run custom pre-build commands
Expand Down
Loading