feat: resuable-docker-build-publish gativ2 support

.changeset/cool-hats-battle.md

@@ -0,0 +1,6 @@
+---
+"reusable-docker-build-publish": minor
+---
+
+feat: pin to setup-github-token/v1, add gati-profile input to support v2
+profiles+migration

.github/workflows/reusable-docker-build-publish.yml

@@ -411,6 +411,14 @@ on:
         required: false
         type: string
         default: "disabled"
+      gati-profile:
+        description: |
+          The GATI v2 specific profile to use.
+          Leave empty for no GATI, or pass the *_GATI_* secrets to use legacy roles.
+          * Note: that usage of secrets will migrate over seamlessly to GATIv2 eventually.
+        type: string
+        required: false
+        default: ""
 
     outputs:
       docker-image-sha-digest-amd64:
@@ -746,25 +754,38 @@ jobs:
           AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }}
           AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }}
           GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }}
+          GATI_V2_PROFILE: ${{ inputs.gati-profile }}
         run: |
-          if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then
-            if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
-                echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
-            fi
-          else
-            echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set."
+          if [[ -n "$GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE" ]]; then
+            echo "Skipping GATI: the build override token is set."
+            exit 0
           fi
 
+          if [[ -n "$GATI_V2_PROFILE" ]]; then
+            echo "Enabling GATI: gati-profile is set."
+            echo "use-gati=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ -n "$AWS_ROLE_GATI_ARN" && -n "$AWS_LAMBDA_GATI_URL" ]]; then
+            echo "Enabling GATI: both AWS GATI secrets are set."
+            echo "use-gati=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Skipping GATI: set gati-profile or both AWS GATI secrets."
+
       - name: Setup GitHub token using GATI
         if: steps.check-gati.outputs.use-gati == 'true'
         id: token
-        uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0
+        uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1
         with:
           aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }}
           aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }}
           aws-region: ${{ inputs.aws-region-gati }}
           aws-role-duration-seconds: "1800"
           set-git-config: ${{ inputs.set-git-config-gati }}
+          profile: ${{ inputs.gati-profile }}
 
       - name: Run custom pre-build commands
         if: ${{ inputs.docker-pre-build-commands != '' }}

workflows/reusable-docker-build-publish/README.md

@@ -145,6 +145,8 @@ This token will be passed to the Docker build action as the token secret.
 
 ### Option B: Use GATI (GitHub Actions Token Issuer)
 
+#### V1
+
 If all of the following are provided:
 
 - `secrets.AWS_ROLE_GATI_ARN`
@@ -154,7 +156,11 @@ If all of the following are provided:
 …the workflow will fetch a token via the `setup-github-token` action and use it
 for the build.
 
-Optional helper:
+#### V2
+
+- Pass `gati-profile` input as the configured GATIv2 profile.
+
+#### Optional helper
 
 - `set-git-config-gati: "true"` to configure git for GATI usage (when needed by
   your build tooling).

workflows/reusable-docker-build-publish/reusable-docker-build-publish.yml

@@ -407,6 +407,14 @@ on:
         required: false
         type: string
         default: "disabled"
+      gati-profile:
+        description: |
+          The GATI v2 specific profile to use.
+          Leave empty for no GATI, or pass the *_GATI_* secrets to use legacy roles.
+          * Note: that usage of secrets will migrate over seamlessly to GATIv2 eventually.
+        type: string
+        required: false
+        default: ""
 
     outputs:
       docker-image-sha-digest-amd64:
@@ -742,25 +750,38 @@ jobs:
           AWS_ROLE_GATI_ARN: ${{ secrets.AWS_ROLE_GATI_ARN }}
           AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_LAMBDA_GATI_URL }}
           GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE: ${{ secrets.GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE }}
+          GATI_V2_PROFILE: ${{ inputs.gati-profile }}
         run: |
-          if [[ -n "${AWS_ROLE_GATI_ARN}" && -n "${AWS_LAMBDA_GATI_URL}" ]]; then
-            if [[ -z "${GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE:-}" ]]; then
-                echo "use-gati=true" | tee -a "${GITHUB_OUTPUT}"
-            fi
-          else
-            echo "Skipping GATI because secrets.AWS_ROLE_GATI_ARN and/or secrets.AWS_LAMBDA_GATI_URL or GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE is not set."
+          if [[ -n "$GITHUB_TOKEN_DOCKER_BUILD_OVERRIDE" ]]; then
+            echo "Skipping GATI: the build override token is set."
+            exit 0
           fi
 
+          if [[ -n "$GATI_V2_PROFILE" ]]; then
+            echo "Enabling GATI: gati-profile is set."
+            echo "use-gati=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ -n "$AWS_ROLE_GATI_ARN" && -n "$AWS_LAMBDA_GATI_URL" ]]; then
+            echo "Enabling GATI: both AWS GATI secrets are set."
+            echo "use-gati=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Skipping GATI: set gati-profile or both AWS GATI secrets."
+
       - name: Setup GitHub token using GATI
         if: steps.check-gati.outputs.use-gati == 'true'
         id: token
-        uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/1.0.0
+        uses: smartcontractkit/.github/actions/setup-github-token@setup-github-token/v1
         with:
           aws-role-arn: ${{ secrets.AWS_ROLE_GATI_ARN }}
           aws-lambda-url: ${{ secrets.AWS_LAMBDA_GATI_URL }}
           aws-region: ${{ inputs.aws-region-gati }}
           aws-role-duration-seconds: "1800"
           set-git-config: ${{ inputs.set-git-config-gati }}
+          profile: ${{ inputs.gati-profile }}
 
       - name: Run custom pre-build commands
         if: ${{ inputs.docker-pre-build-commands != '' }}