ci(e2e): use OIDC for AWS ECR

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Merge pull request #1555 from crazy-max/e2e-dockerhub
2026-06-10 13:38:03 +00:00 · 2026-06-10 13:05:34 +02:00 · 2026-06-08 19:08:26 +02:00 · 2026-06-04 16:03:24 +02:00 · 2026-06-04 16:00:12 +02:00 · 2026-06-02 14:18:39 +02:00
4 changed files with 65 additions and 49 deletions
@@ -1,9 +1,6 @@
 # reusable workflow
 name: .e2e-run

-permissions:
-  contents: read
-
 on:
  workflow_call:
    inputs:
@@ -13,6 +10,9 @@ on:
      type:
        required: true
        type: string
+      provider:
+        required: true
+        type: string
      name:
        required: true
        type: string
@@ -100,7 +100,7 @@ jobs:
            type=raw,gh-runid-${{ github.run_id }}
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -111,14 +111,21 @@ jobs:
          driver-opts: |
            image=${{ matrix.buildkit_image }}
            network=host
+      -
+        name: Configure AWS credentials
+        if: inputs.provider == 'aws'
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+          aws-region: us-east-1
      -
        name: Login to Registry
-        if: github.event_name != 'pull_request' && (inputs.type == 'remote' || env.REGISTRY_USER != '')
+        if: github.event_name != 'pull_request' && (inputs.type == 'remote' || inputs.provider == 'aws' || env.REGISTRY_USER != '')
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY_FQDN || inputs.registry }}
-          username: ${{ env.REGISTRY_USER || secrets.registry_username }}
-          password: ${{ env.REGISTRY_PASSWORD || secrets.registry_password }}
+          username: ${{ env.REGISTRY_USER || secrets.registry_username || (inputs.registry == 'ghcr.io' && github.actor) || '' }}
+          password: ${{ env.REGISTRY_PASSWORD || secrets.registry_password || (inputs.registry == 'ghcr.io' && secrets.GITHUB_TOKEN) || '' }}
          scope: ${{ inputs.type == 'remote' && inputs.registry == '' && '@push' || '' }}
      -
        name: Build and push
@@ -67,7 +67,7 @@ jobs:
          path: action
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        id: buildx
@@ -118,7 +118,7 @@ jobs:
          path: action
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        id: buildx
@@ -167,7 +167,7 @@ jobs:
          path: action
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        id: buildx
@@ -224,7 +224,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        id: buildx
@@ -355,7 +355,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -803,7 +803,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        id: buildx
@@ -942,7 +942,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -991,7 +991,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -1032,7 +1032,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -1345,7 +1345,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -1394,7 +1394,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -20,6 +20,10 @@ on:
 jobs:
  build:
    uses: ./.github/workflows/.e2e-run.yml
+    permissions:
+      contents: read
+      id-token: write # to get AWS credentials
+      packages: write # to push image to GHCR
    strategy:
      fail-fast: false
      matrix:
@@ -27,101 +31,100 @@ jobs:
          -
            name: Distribution
            id: distribution
-            auth: none
+            provider: none
            type: local
          -
            name: Docker Hub
            registry: ''
-            slug: ghactionstest/ghactionstest
-            auth: dockerhub
+            slug: dockereng/build-push-action-test
+            provider: dockerhub
            type: remote
          -
            name: GitHub
            registry: ghcr.io
-            slug: ghcr.io/docker-ghactiontest/test
-            auth: ghcr
+            slug: ghcr.io/docker/build-push-action-test
+            provider: ghcr
            type: remote
          -
            name: GitLab
            registry: registry.gitlab.com
            slug: registry.gitlab.com/test1716/test
-            auth: gitlab
+            provider: gitlab
            type: remote
          -
            name: AWS ECR
            registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
            slug: 175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
-            auth: aws
+            provider: aws
            type: remote
          -
            name: AWS ECR Public
            registry: public.ecr.aws
            slug: public.ecr.aws/q3b5f1u4/test-docker-action
-            auth: aws
+            provider: aws
            type: remote
          -
            name: Google Artifact Registry
            registry: us-east4-docker.pkg.dev
            slug: us-east4-docker.pkg.dev/sandbox-298914/docker-official-github-actions/test-docker-action
-            auth: gar
+            provider: gar
            type: remote
          -
            name: Azure Container Registry
            registry: officialgithubactions.azurecr.io
            slug: officialgithubactions.azurecr.io/test-docker-action
-            auth: acr
+            provider: acr
            type: remote
          -
            name: Quay
            registry: quay.io
            slug: quay.io/docker_build_team/ghactiontest
-            auth: quay
+            provider: quay
            type: remote
          -
            name: Artifactory
            registry: infradock.jfrog.io
            slug: infradock.jfrog.io/test-ghaction/build-push-action
-            auth: artifactory
+            provider: artifactory
            type: remote
          -
            name: Harbor
            id: harbor
-            auth: none
+            provider: none
            type: local
          -
            name: Nexus
            id: nexus
-            auth: none
+            provider: none
            type: local
    with:
      id: ${{ matrix.id }}
      type: ${{ matrix.type }}
+      provider: ${{ matrix.provider }}
      name: ${{ matrix.name }}
      registry: ${{ matrix.registry }}
      slug: ${{ matrix.slug }}
    secrets:
-      # Pass only the two secrets needed by each matrix entry.
+      # Pass only the registry-specific secrets needed by each matrix entry.
+      # GHCR uses the called workflow's GITHUB_TOKEN fallback.
+      # AWS ECR uses OIDC to get credentials.
      registry_username: >-
        ${{
-          matrix.auth == 'dockerhub' && secrets.DOCKERHUB_USERNAME ||
-          matrix.auth == 'ghcr' && secrets.GHCR_USERNAME ||
-          matrix.auth == 'gitlab' && secrets.GITLAB_USERNAME ||
-          matrix.auth == 'aws' && secrets.AWS_ACCESS_KEY_ID ||
-          matrix.auth == 'gar' && secrets.GAR_USERNAME ||
-          matrix.auth == 'acr' && secrets.AZURE_CLIENT_ID ||
-          matrix.auth == 'quay' && secrets.QUAY_USERNAME ||
-          matrix.auth == 'artifactory' && secrets.ARTIFACTORY_USERNAME ||
+          matrix.provider == 'dockerhub' && vars.DOCKERPUBLICBOT_USERNAME ||
+          matrix.provider == 'gitlab' && secrets.GITLAB_USERNAME ||
+          matrix.provider == 'gar' && secrets.GAR_USERNAME ||
+          matrix.provider == 'acr' && secrets.AZURE_CLIENT_ID ||
+          matrix.provider == 'quay' && secrets.QUAY_USERNAME ||
+          matrix.provider == 'artifactory' && secrets.ARTIFACTORY_USERNAME ||
          ''
        }}
      registry_password: >-
        ${{
-          matrix.auth == 'dockerhub' && secrets.DOCKERHUB_TOKEN ||
-          matrix.auth == 'ghcr' && secrets.GHCR_PAT ||
-          matrix.auth == 'gitlab' && secrets.GITLAB_TOKEN ||
-          matrix.auth == 'aws' && secrets.AWS_SECRET_ACCESS_KEY ||
-          matrix.auth == 'gar' && secrets.GAR_JSON_KEY ||
-          matrix.auth == 'acr' && secrets.AZURE_CLIENT_SECRET ||
-          matrix.auth == 'quay' && secrets.QUAY_TOKEN ||
-          matrix.auth == 'artifactory' && secrets.ARTIFACTORY_TOKEN ||
+          matrix.provider == 'dockerhub' && secrets.DOCKERPUBLICBOT_WRITE_PAT ||
+          matrix.provider == 'gitlab' && secrets.GITLAB_TOKEN ||
+          matrix.provider == 'gar' && secrets.GAR_JSON_KEY ||
+          matrix.provider == 'acr' && secrets.AZURE_CLIENT_SECRET ||
+          matrix.provider == 'quay' && secrets.QUAY_TOKEN ||
+          matrix.provider == 'artifactory' && secrets.ARTIFACTORY_TOKEN ||
          ''
        }}
@@ -0,0 +1,6 @@
+rules:
+  # rule does not apply to reusable worfklows where permissions are defined by
+  # the caller workflow and not the reusable workflow itself
+  excessive-permissions:
+    ignore:
+      - .e2e-run.yml
Author	SHA1	Message	Date
CrazyMax	2fe276c794	ci(e2e): use OIDC for AWS ECR Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-06-10 13:05:34 +02:00
CrazyMax	f72b3cf665	Merge pull request #1555 from crazy-max/e2e-dockerhub ci(e2e): use org-owned Docker Hub credentials for e2e pushes	2026-06-08 19:08:26 +02:00
CrazyMax	405b217da0	ci(e2e): use org-owned Docker Hub credentials for e2e pushes Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-06-04 16:03:24 +02:00
CrazyMax	7b93b2b85c	Merge pull request #1554 from crazy-max/e2e-ghcr ci(e2e): use GITHUB_TOKEN for GHCR e2e	2026-06-04 16:00:12 +02:00
CrazyMax	f55bd083f2	ci(e2e): use GITHUB_TOKEN for GHCR e2e Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-06-02 14:18:39 +02:00