1515 name : jsii/superchain
1616 permissions :
1717 contents : read
18+ id-token : write # Necessary for OIDC federation
1819 runs-on : ubuntu-latest
1920 strategy :
2021 matrix :
@@ -45,13 +46,49 @@ jobs:
4546 echo '⏯ Dockerfile changed'
4647 echo "::set-output name=result::true"
4748 else
48- echo '⏭ Dockerfile not changed'
49- echo "::set-output name=result::false"
49+ if grep '.github/workflows/docker-images.yml' <<< "${changed}" ; then
50+ echo '⏯ docker-images workflow changed'
51+ echo "::set-output name=result::true"
52+ else
53+ echo '⏭ Dockerfile not changed'
54+ echo "::set-output name=result::false"
55+ fi
5056 fi
5157 fi
5258
59+ # Check if federation into AWS is configured. This is necessary because
60+ # GitHub does not interpret ${{ secret.FOO }} within `if:` conditions...
61+ # See: https://github.com/actions/runner/issues/520
62+ - name : Check AWS federation configuration
63+ id : federate_to_aws
64+ if : steps.should-run.outputs.result == 'true'
65+ run : |-
66+ if [[ "${{ secrets.AWS_ROLE_TO_ASSUME }}" != "" ]]; then
67+ echo "🔑 Federation into AWS is possible (AWS_ROLE_TO_ASSUME is available)"
68+ echo "::set-output name=enabled::true"
69+ else
70+ echo "❌ Federation into AWS is disabled (no AWS_ROLE_TO_ASSUME secret found)"
71+ echo "::set-output name=enabled::false"
72+ fi
73+
74+ # Federate into the PR Validation AWS Account
75+ - name : Federate into AWS
76+ if : steps.should-run.outputs.result == 'true' && steps.federate_to_aws.outputs.enabled == 'true'
77+ uses : aws-actions/configure-aws-credentials@v1
78+ with :
79+ aws-region : us-east-1
80+ role-to-assume : ${{ secrets.AWS_ROLE_TO_ASSUME }}
81+ role-session-name : GHA_aws-jsii_docker-images
82+
83+ # Login to ECR Public registry, so we don't get throttled at 1 TPS
84+ - name : Login to ECR Public
85+ if : steps.should-run.outputs.result == 'true' && steps.federate_to_aws.outputs.enabled == 'true'
86+ run : |-
87+ aws ecr-public get-login-password --region=us-east-1 \
88+ | docker login --username AWS --password-stdin public.ecr.aws
89+
5390# We only authenticate to Docker on the 'aws/jsii' repo, as forks will not have the secret
54- - name : Login to Docker
91+ - name : Login to Docker Hub
5592 if : steps.should-run.outputs.result == 'true' && github.repository == 'aws/jsii'
5693 # The DOCKER_CREDENTIALS secret is expected to contain a username:token pair
5794 run : |-
@@ -70,6 +107,12 @@ jobs:
70107 id : buildx
71108 if : steps.should-run.outputs.result == 'true'
72109 uses : docker/setup-buildx-action@v2
110+ with :
111+ # Disable parallelism because IO contention makes it too slow on GitHub
112+ # workers...
113+ config-inline : |-
114+ [worker.oci]
115+ max-parallelism = 1
73116
74117# We only restore GH cache if we are not going to publish the result (i.e: PR validation)
75118 - name : Set up layer cache
85128# 1 pull per second from ECR Public
86129 - name : Jitter the start time to avoid ECR Public throttling
87130 id : sleep-start
88- if : steps.should-run.outputs.result == 'true'
131+ if : steps.should-run.outputs.result == 'true' && steps.federate_to_aws.outputs.enabled != true
89132 run : |-
90133 sleep $((RANDOM % 60))
91134
@@ -111,27 +154,12 @@ jobs:
111154 -f superchain/Dockerfile \
112155 .
113156
114- # Testing sequentially, because in parallel it's too slow due to IO contention
115- - name : Test Image (AMD64)
116- if : steps.should-run.outputs.result == 'true'
117- run : |-
118- docker buildx build \
119- --builder ${{ steps.buildx.outputs.name }} \
120- --platform linux/amd64 \
121- --target superchain \
122- --cache-from type=local,src=/tmp/.buildx-cache \
123- --cache-to type=local,dest=/tmp/.buildx-cache \
124- --build-arg BUILD_TIMESTAMP="${{ steps.build-time.outputs.value }}" \
125- --build-arg COMMIT_ID='${{ github.sha }}' \
126- --build-arg NODE_MAJOR_VERSION=${{ matrix.node }} \
127- -f superchain/Dockerfile \
128- .
129- name : Test Image (ARM64)
157+ name : Test Image
130158 if : steps.should-run.outputs.result == 'true'
131159 run : |-
132160 docker buildx build \
133161 --builder ${{ steps.buildx.outputs.name }} \
134- --platform linux/arm64 \
162+ --platform linux/amd64,linux/ arm64 \
135163 --target superchain \
136164 --cache-from type=local,src=/tmp/.buildx-cache \
137165 --cache-to type=local,dest=/tmp/.buildx-cache \
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments