feat: push Docker images to GHCR (#66)

dvsa · Apr 16, 2024 · 144fe55 · 144fe55
1 parent 99694df
commit 144fe55
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 5 deletions.
diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
@@ -214,6 +214,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      packages: write
 
   terraform-account-nonprod:
     name: Account (nonprod)

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -26,7 +26,8 @@ on:
 
 env:
   WORKING_DIR: infra/docker/${{ inputs.project }}
-  ECR_REGISTRY: 054614622558.dkr.ecr.eu-west-1.amazonaws.com
+  REGISTRY: 054614622558.dkr.ecr.eu-west-1.amazonaws.com
+  REGISTRY_MIRROR: ghcr.io
   AWS_OIDC_ROLE: ${{ vars[format('ACCOUNT_nonprod_TF_OIDC{0}_ROLE', (inputs.should-upload-artefact-to-ecr && '' || '_READONLY'))] || (inputs.should-upload-artefact-to-ecr && vars.TF_OIDC_ROLE || vars.TF_OIDC_READONLY_ROLE) }}
   AWS_REGION: ${{ vars.TF_AWS_REGION }}
 
@@ -65,7 +66,9 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.ECR_REGISTRY }}/vol-app/${{ inputs.project }}
+          images: |
+            ${{ env.REGISTRY }}/vol-app/${{ inputs.project }}
+            ${{ env.REGISTRY_MIRROR }}/dvsa/vol-app/${{ inputs.project }}
           tags: |
             type=sha,format=short
             type=semver,enable=${{ inputs.is-release }},pattern={{version}},value=${{ inputs.version }}
@@ -82,9 +85,17 @@ jobs:
         if: ${{ inputs.should-upload-artefact-to-ecr }}
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.ECR_REGISTRY }}
+          registry: ${{ env.REGISTRY }}
 
-      - name: Untag existing latest image
+      - name: Login to GHCR
+        if: ${{ inputs.should-upload-artefact-to-ecr }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY_MIRROR }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Untag existing latest image in ECR
         if: ${{ inputs.should-upload-artefact-to-ecr }}
         run: |
           aws ecr batch-delete-image --repository-name vol-app/${{ inputs.project }} --image-ids imageTag=latest
@@ -115,4 +126,4 @@ jobs:
           plugin_url: https://d2hvyiie56hcat.cloudfront.net/linux/amd64/plugin/latest/notation-aws-signer-plugin.zip
           plugin_checksum: cccfe8fdcdf853d83fd57ffc80524eddda75ad7ae9d9a257b087007230ec02f9
           key_id: arn:aws:signer:eu-west-1:054614622558:/signing-profiles/vol_app_20240313124948142600000001
-          target_artifact_reference: ${{ env.ECR_REGISTRY }}/vol-app/${{ inputs.project }}@${{ steps.build-and-push.outputs.digest }}
+          target_artifact_reference: ${{ env.REGISTRY }}/vol-app/${{ inputs.project }}@${{ steps.build-and-push.outputs.digest }}
diff --git a/docs/infrastructure/docker/overview.md b/docs/infrastructure/docker/overview.md
@@ -8,6 +8,12 @@ Docker images are built and pushed to ECR during the CD pipeline, refer to the [
 
 ![Docker Images](../../assets/docker-images.png)
 
+:::info
+
+Images are also pushed to the GitHub Container Registry (GHCR) for public access. Refer to the [RFC-006](../../rfc/rfc-006-public-ecr.md) for more details.
+
+:::
+
 # Layers
 
 The VOL application images are built up of the following high-level layers: