Skip to content

ci: use deploy-ecr for production image publish #387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
drernie wants to merge 2 commits into from
Closed

ci: use deploy-ecr for production image publish #387

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58496f3
Use deploy-ecr for production image publish
drernie Apr 29, 2026
ddbaa03
ci: repin gh-actions reference to docker-build-publish
drernie Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 17 additions & 24 deletions .github/workflows/prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest

outputs:
image_uri_sha: ${{ steps.image.outputs.IMAGE_URI_SHA }}
image_uri_sha: ${{ steps.deploy.outputs.image_uri_prod }}
image_uri_latest: ${{ steps.image.outputs.IMAGE_URI_LATEST }}
git_sha: ${{ steps.git.outputs.GIT_SHA }}

Expand Down Expand Up @@ -50,38 +50,31 @@ jobs:
working-directory: docker
run: uv sync --all-extras

- name: Configure AWS credentials (OIDC)
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: arn:aws:iam::730278974607:role/github/GitHub-benchling-webhook
aws-region: us-east-1

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
with:
platforms: linux/amd64

- name: Build and push Docker image
working-directory: docker
run: make push-ci VERSION=${{ steps.git.outputs.GIT_SHA }}
env:
DOCKER_DEFAULT_PLATFORM: linux/amd64
AWS_REGION: us-east-1

- name: Get Docker image URIs
id: deploy
uses: quiltdata/gh-actions/docker-build-publish@docker-build-publish
with:
dockerfile_path: docker/Dockerfile
docker_context_path: docker
docker_platform: linux/amd64
build_args: |
VERSION=${{ steps.git.outputs.GIT_SHA }}
image_name: quiltdata/benchling
additional_tags: '["latest"]'
push_targets: '["prod"]'
Comment on lines 58 to +69
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 AWS credentials missing in build-and-push job

The aws-actions/configure-aws-credentials step (with role-to-assume: arn:aws:iam::730278974607:role/github/GitHub-benchling-webhook) was removed from this job, and no equivalent credential inputs (e.g. role_to_assume, aws_region) are passed to the deploy-ecr action. If the action doesn't configure OIDC authentication internally, the ECR push will fail with an auth error. The id-token: write permission is still declared, but the workflow no longer wires any role ARN into the build-and-push job context.


- name: Record Docker image URIs
id: image
run: |
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
GIT_SHA="${{ steps.git.outputs.GIT_SHA }}"
IMAGE_URI_SHA="${AWS_ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/quiltdata/benchling:${GIT_SHA}"
IMAGE_URI_LATEST="${AWS_ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/quiltdata/benchling:latest"

echo "IMAGE_URI_SHA=$IMAGE_URI_SHA" >> $GITHUB_OUTPUT
echo "IMAGE_URI_LATEST=$IMAGE_URI_LATEST" >> $GITHUB_OUTPUT

echo "IMAGE_URI_LATEST=730278974607.dkr.ecr.us-east-1.amazonaws.com/quiltdata/benchling:latest" >> "$GITHUB_OUTPUT"
echo "Docker Images:"
echo " SHA: $IMAGE_URI_SHA"
echo " Latest: $IMAGE_URI_LATEST"
echo " SHA: ${{ steps.deploy.outputs.image_uri_prod }}"
echo " Latest: 730278974607.dkr.ecr.us-east-1.amazonaws.com/quiltdata/benchling:latest"

validate:
name: Validate Production Image
Expand Down