Skip to content

chore: synced file(s) with cds-snc/site-reliability-engineering (#434) #170

chore: synced file(s) with cds-snc/site-reliability-engineering (#434)

chore: synced file(s) with cds-snc/site-reliability-engineering (#434) #170

name: Docker build and push
on:
push:
branches:
- main
env:
AWS_REGION: ca-central-1
FUNCTION_PREFIX: gc-design-system
GITHUB_SHA: ${{ github.sha }}
REGISTRY: 307395567143.dkr.ecr.ca-central-1.amazonaws.com/gc-design-system
permissions:
id-token: write
contents: write
security-events: write
jobs:
changes:
runs-on: ubuntu-latest
outputs:
images: ${{ steps.filter.outputs.changes }}
steps:
- name: Checkout
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
- uses: dorny/paths-filter@7267a8516b6f92bdb098633497bad573efdbf271 # v2.12.0
id: filter
with:
filters: |
api: 'api/**'
build-push:
if: needs.changes.outputs.images != '[]'
runs-on: ubuntu-latest
needs: changes
strategy:
fail-fast: false
matrix:
image: ${{ fromJSON(needs.changes.outputs.images) }}
steps:
- name: Checkout
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
- name: Configure AWS credentials using OIDC
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: arn:aws:iam::307395567143:role/gcds-docs-apply
role-session-name: ECRPush
aws-region: ${{ env.AWS_REGION }}
- name: Build image
working-directory: ./${{ matrix.image }}
run: |
docker build \
--build-arg GIT_SHA=$GITHUB_SHA \
-t $REGISTRY/${{ matrix.image }}:$GITHUB_SHA \
-t $REGISTRY/${{ matrix.image }}:latest .
- name: Login to ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@5a88a04c91d5c6f97aae0d9be790e64d9b1d47b7 # v1.7.1
- name: Push image to ECR
run: |
docker push $REGISTRY/${{ matrix.image }}:$GITHUB_SHA
docker push $REGISTRY/${{ matrix.image }}:latest
- name: Deploy new image
run: |
aws lambda update-function-code \
--function-name ${{ env.FUNCTION_PREFIX }}-${{ matrix.image }} \
--image-uri $REGISTRY/${{ matrix.image }}:$GITHUB_SHA > /dev/null 2>&1
- name: Docker generate SBOM
uses: cds-snc/security-tools/.github/actions/generate-sbom@598deeaed48ab3bb0df85f0ed124ba53f0ade385 # v3.1.0
with:
docker_image: "${{ env.REGISTRY }}/${{ matrix.image }}:${{ env.GITHUB_SHA }}"
dockerfile_path: "${{ matrix.image }}/Dockerfile"
sbom_name: "${{ matrix.image }}"
token: "${{ secrets.GITHUB_TOKEN }}"
- name: Logout of Amazon ECR
run: docker logout ${{ steps.login-ecr.outputs.registry }}