diff --git a/.changeset/cool-hats-battle.md b/.changeset/cool-hats-battle.md new file mode 100644 index 000000000..d0e0a5857 --- /dev/null +++ b/.changeset/cool-hats-battle.md @@ -0,0 +1,6 @@ +--- +"reusable-docker-build-publish": minor +--- + +feat: pin to setup-github-token/v1, add gati-profile input to support v2 +profiles+migration diff --git a/.github/workflows/reusable-docker-build-publish.yml b/.github/workflows/reusable-docker-build-publish.yml index 8a7485153..16bc79097 100644 --- a/.github/workflows/reusable-docker-build-publish.yml +++ b/.github/workflows/reusable-docker-build-publish.yml @@ -411,6 +411,14 @@ on: required: false type: string default: "disabled" + gati-profile: + description: | + The GATI v2 specific profile to use. + Leave empty for no GATI, or pass the *_GATI_* secrets to use legacy roles. + * Note: that usage of secrets will migrate over seamlessly to GATIv2 eventually. + type: string + required: false + default: "" outputs: docker-image-sha-digest-amd64: @@ -746,25 +754,38 @@ jobs: AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }} AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }} GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }} + GATI_V2_PROFILE: ${{ inputs.gati-profile }} run: | - if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then - if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then - echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" - fi - else - echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set." + if [[ -n "$GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE" ]]; then + echo "Skipping GATI: the build override token is set." + exit 0 fi + if [[ -n "$GATI_V2_PROFILE" ]]; then + echo "Enabling GATI: gati-profile is set." + echo "use-gati=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + if [[ -n "$AWS_ROLE_GATI_ARN" && -n "$AWS_LAMBDA_GATI_URL" ]]; then + echo "Enabling GATI: both AWS GATI secrets are set." + echo "use-gati=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + echo "Skipping GATI: set gati-profile or both AWS GATI secrets." + - name: Setup GitHub token using GATI if: steps.check-gati.outputs.use-gati == 'true' id: token - uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0 + uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1 with: aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }} aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }} aws-region: ${{ inputs.aws-region-gati }} aws-role-duration-seconds: "1800" set-git-config: ${{ inputs.set-git-config-gati }} + profile: ${{ inputs.gati-profile }} - name: Run custom pre-build commands if: ${{ inputs.docker-pre-build-commands != '' }} diff --git a/workflows/reusable-docker-build-publish/README.md b/workflows/reusable-docker-build-publish/README.md index 74322937e..83d52873e 100644 --- a/workflows/reusable-docker-build-publish/README.md +++ b/workflows/reusable-docker-build-publish/README.md @@ -145,6 +145,8 @@ This token will be passed to the Docker build action as the token secret. ### Option B: Use GATI (GitHub Actions Token Issuer) +#### V1 + If all of the following are provided: - `secrets.AWS_ROLE_GATI_ARN` @@ -154,7 +156,11 @@ If all of the following are provided: …the workflow will fetch a token via the `setup-github-token` action and use it for the build. -Optional helper: +#### V2 + +- Pass `gati-profile` input as the configured GATIv2 profile. + +#### Optional helper - `set-git-config-gati: "true"` to configure git for GATI usage (when needed by your build tooling). diff --git a/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml b/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml index 45be8d2cb..6869e6ba4 100644 --- a/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml +++ b/workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml @@ -407,6 +407,14 @@ on: required: false type: string default: "disabled" + gati-profile: + description: | + The GATI v2 specific profile to use. + Leave empty for no GATI, or pass the *_GATI_* secrets to use legacy roles. + * Note: that usage of secrets will migrate over seamlessly to GATIv2 eventually. + type: string + required: false + default: "" outputs: docker-image-sha-digest-amd64: @@ -742,25 +750,38 @@ jobs: AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }} AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }} GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }} + GATI_V2_PROFILE: ${{ inputs.gati-profile }} run: | - if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then - if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then - echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}" - fi - else - echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set." + if [[ -n "$GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE" ]]; then + echo "Skipping GATI: the build override token is set." + exit 0 fi + if [[ -n "$GATI_V2_PROFILE" ]]; then + echo "Enabling GATI: gati-profile is set." + echo "use-gati=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + if [[ -n "$AWS_ROLE_GATI_ARN" && -n "$AWS_LAMBDA_GATI_URL" ]]; then + echo "Enabling GATI: both AWS GATI secrets are set." + echo "use-gati=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + echo "Skipping GATI: set gati-profile or both AWS GATI secrets." + - name: Setup GitHub token using GATI if: steps.check-gati.outputs.use-gati == 'true' id: token - uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0 + uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1 with: aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }} aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }} aws-region: ${{ inputs.aws-region-gati }} aws-role-duration-seconds: "1800" set-git-config: ${{ inputs.set-git-config-gati }} + profile: ${{ inputs.gati-profile }} - name: Run custom pre-build commands if: ${{ inputs.docker-pre-build-commands != '' }}