build/bake: registry identities support

.github/workflows/.test-bake.yml

@@ -16,12 +16,14 @@ on:
  paths:
  - '.github/workflows/.test-bake.yml'
  - '.github/workflows/bake.yml'
+ - '.github/workflows/setup-registry-identities.yml'
  - '.github/workflows/verify.yml'
  - 'test/**'
  pull_request:
  paths:
  - '.github/workflows/.test-bake.yml'
  - '.github/workflows/bake.yml'
+ - '.github/workflows/setup-registry-identities.yml'
  - '.github/workflows/verify.yml'
  - 'test/**'
 
@@ -80,6 +82,54 @@ jobs:
  const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
  core.info(JSON.stringify(builderOutputs, null, 2));
 
+ bake-ecr-public:
+ uses: ./.github/workflows/bake.yml
+ if: ${{ github.event_name != 'pull_request' }}
+ permissions:
+ contents: read
+ id-token: write
+ with:
+ context: test
+ output: image
+ push: true
+ sbom: true
+ set: |
+ *.args.VERSION={{meta.version}}
+ target: hello
+ registry-identities: |
+ - type: aws-ecr
+ aws-region: us-east-1
+ role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+ registry: public.ecr.aws
+ meta-images: |
+ public.ecr.aws/q3b5f1u4/test-docker-action
+ meta-tags: |
+ type=raw,value=bake-ecr-public-${{ github.run_id }}
+
+ bake-ecr-private:
+ uses: ./.github/workflows/bake.yml
+ if: ${{ github.event_name != 'pull_request' }}
+ permissions:
+ contents: read
+ id-token: write
+ with:
+ context: test
+ output: image
+ push: true
+ sbom: true
+ set: |
+ *.args.VERSION={{meta.version}}
+ target: hello
+ registry-identities: |
+ - type: aws-ecr
+ aws-region: us-east-1
+ role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+ registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
+ meta-images: |
+ 175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
+ meta-tags: |
+ type=raw,value=bake-ecr-private-${{ github.run_id }}
+
  bake-dockerhub:
  uses: ./.github/workflows/bake.yml
  permissions:

.github/workflows/.test-build.yml

@@ -16,12 +16,14 @@ on:
  paths:
  - '.github/workflows/.test-build.yml'
  - '.github/workflows/build.yml'
+ - '.github/workflows/setup-registry-identities.yml'
  - '.github/workflows/verify.yml'
  - 'test/**'
  pull_request:
  paths:
  - '.github/workflows/.test-build.yml'
  - '.github/workflows/build.yml'
+ - '.github/workflows/setup-registry-identities.yml'
  - '.github/workflows/verify.yml'
  - 'test/**'
 
@@ -79,6 +81,52 @@ jobs:
  const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
  core.info(JSON.stringify(builderOutputs, null, 2));
 
+ build-ecr-public:
+ uses: ./.github/workflows/build.yml
+ if: ${{ github.event_name != 'pull_request' }}
+ permissions:
+ contents: read
+ id-token: write
+ with:
+ build-args: |
+ VERSION={{meta.version}}
+ file: test/hello.Dockerfile
+ output: image
+ push: true
+ sbom: true
+ registry-identities: |
+ - type: aws-ecr
+ aws-region: us-east-1
+ role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+ registry: public.ecr.aws
+ meta-images: |
+ public.ecr.aws/q3b5f1u4/test-docker-action
+ meta-tags: |
+ type=raw,value=build-ecr-public-${{ github.run_id }}
+
+ build-ecr-private:
+ uses: ./.github/workflows/build.yml
+ if: ${{ github.event_name != 'pull_request' }}
+ permissions:
+ contents: read
+ id-token: write
+ with:
+ build-args: |
+ VERSION={{meta.version}}
+ file: test/hello.Dockerfile
+ output: image
+ push: true
+ sbom: true
+ registry-identities: |
+ - type: aws-ecr
+ aws-region: us-east-1
+ role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+ registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
+ meta-images: |
+ 175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
+ meta-tags: |
+ type=raw,value=build-ecr-private-${{ github.run_id }}
+
  build-dockerhub:
  uses: ./.github/workflows/build.yml
  permissions:

.github/workflows/.update-deps.yml

@@ -168,6 +168,7 @@ jobs:
  files: [
  '.github/workflows/build.yml',
  '.github/workflows/bake.yml',
+ '.github/workflows/setup-registry-identities.yml',
  '.github/workflows/verify.yml'
  ],
  sourceUrl: 'https://www.npmjs.com/package/@docker/github-builder-runtime',

.github/workflows/bake.yml

@@ -100,6 +100,10 @@ on:
  type: string
  description: "Variables to set in the Bake definition as list of key-value pair"
  required: false
+ registry-identities:
+ type: string
+ description: "Keyless registry identity configuration as YAML objects"
+ required: false
  # docker/metadata-action
  set-meta-annotations:
  type: boolean
@@ -188,6 +192,11 @@ env:
  NPM_CONFIG_FETCH_RETRIES: "5"
 
 jobs:
+ registry-identities:
+ uses: ./.github/workflows/setup-registry-identities.yml
+ with:
+ registry-identities: ${{ inputs.registry-identities }}
+
  prepare:
  runs-on: ubuntu-24.04
  strategy:
@@ -592,7 +601,10 @@ jobs:
  build:
  runs-on: ${{ matrix.runner }}
  needs:
+ - registry-identities
  - prepare
+ env:
+ REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
  strategy:
  fail-fast: ${{ inputs.fail-fast }}
  matrix:
@@ -974,9 +986,22 @@ jobs:
  core.info(JSON.stringify(bakeOverrides, null, 2));
  core.setOutput('overrides', bakeOverrides.join(os.EOL));
  });
+ -
+ name: Configure AWS credentials
+ if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+ with:
+ role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
+ aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
+ -
+ name: Login to Amazon ECR
+ if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+ with:
+ registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
  -
  name: Login to registry
- if: ${{ inputs.push && inputs.output == 'image' }}
+ if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}
@@ -1008,7 +1033,7 @@ jobs:
  core.setOutput('digest', imageDigest);
  -
  name: Login to registry for signing
- if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
+ if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}
@@ -1140,8 +1165,11 @@ jobs:
  output-type: ${{ inputs.output }}
  signed: ${{ needs.prepare.outputs.sign }}
  needs:
+ - registry-identities
  - prepare
  - build
+ env:
+ REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
  steps:
  -
  name: Install dependencies
@@ -1178,9 +1206,22 @@ jobs:
  labels: ${{ inputs.meta-labels }}
  annotations: ${{ inputs.meta-annotations }}
  bake-target: ${{ inputs.meta-bake-target }}
+ -
+ name: Configure AWS credentials
+ if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+ with:
+ role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
+ aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
+ -
+ name: Login to Amazon ECR
+ if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+ with:
+ registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
  -
  name: Login to registry
- if: ${{ inputs.push && inputs.output == 'image' }}
+ if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}

.github/workflows/build.yml

@@ -115,6 +115,10 @@ on:
  type: string
  description: "Ulimit options (e.g., nofile=1024:1024)"
  required: false
+ registry-identities:
+ type: string
+ description: "Keyless registry identity configuration as YAML objects"
+ required: false
  # docker/metadata-action
  set-meta-annotations:
  type: boolean
@@ -191,6 +195,11 @@ env:
  NPM_CONFIG_FETCH_RETRIES: "5"
 
 jobs:
+ registry-identities:
+ uses: ./.github/workflows/setup-registry-identities.yml
+ with:
+ registry-identities: ${{ inputs.registry-identities }}
+
  prepare:
  runs-on: ubuntu-24.04
  strategy:
@@ -484,7 +493,10 @@ jobs:
  build:
  runs-on: ${{ matrix.runner }}
  needs:
+ - registry-identities
  - prepare
+ env:
+ REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
  strategy:
  fail-fast: ${{ inputs.fail-fast }}
  matrix:
@@ -832,9 +844,22 @@ jobs:
  // for a public repository, we set max provenance mode
  core.setOutput('provenance', Build.resolveProvenanceAttrs(`mode=max,version=v1`));
  }
+ -
+ name: Configure AWS credentials
+ if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+ with:
+ role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
+ aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
+ -
+ name: Login to Amazon ECR
+ if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+ with:
+ registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
  -
  name: Login to registry
- if: ${{ inputs.push && inputs.output == 'image' }}
+ if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}
@@ -863,7 +888,7 @@ jobs:
  GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
  -
  name: Login to registry for signing
- if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
+ if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}
@@ -995,8 +1020,11 @@ jobs:
  output-type: ${{ inputs.output }}
  signed: ${{ needs.prepare.outputs.sign }}
  needs:
+ - registry-identities
  - prepare
  - build
+ env:
+ REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
  steps:
  -
  name: Install dependencies
@@ -1032,9 +1060,22 @@ jobs:
  flavor: ${{ inputs.meta-flavor }}
  labels: ${{ inputs.meta-labels }}
  annotations: ${{ inputs.meta-annotations }}
+ -
+ name: Configure AWS credentials
+ if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+ with:
+ role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
+ aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
+ -
+ name: Login to Amazon ECR
+ if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
+ uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+ with:
+ registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
  -
  name: Login to registry
- if: ${{ inputs.push && inputs.output == 'image' }}
+ if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
  uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  registry-auth: ${{ secrets.registry-auths }}