Skip to content

ci: re-enable ECR push for duckgres-worker and duckgres-controlplane CDs#509

Merged
fuziontech merged 1 commit intomainfrom
feat/ci-reenable-ecr-push
May 1, 2026
Merged

ci: re-enable ECR push for duckgres-worker and duckgres-controlplane CDs#509
fuziontech merged 1 commit intomainfrom
feat/ci-reenable-ecr-push

Conversation

@fuziontech
Copy link
Copy Markdown
Member

@fuziontech fuziontech commented May 1, 2026

Summary

Reverts the GHCR-only workaround from #507 now that the ECR repos exist.
Verified via the apply log: "Apply complete! Resources: 6 added, 0 changed, 0 destroyed." (2 ECR repos + 2 lifecycle policies + 2 cross-account aws_ecr_repository_policy entries).

Changes

In both .github/workflows/container-image-worker-cd.yml and container-image-controlplane-cd.yml:

  • Restored ECR_REGISTRY: xxx.dkr.ecr.us-east-1.amazonaws.com in the env: block.
  • Restored aws-actions/configure-aws-credentials + amazon-ecr-login steps in both the build and manifest jobs.
  • Restored ECR tags in the docker/build-push-action tags: lists so per-arch images push to both ECR and GHCR.
  • Restored ECR docker buildx imagetools create calls in manifest assembly.
  • Worker workflow's "Tag default version as and latest" step retags both ECR and GHCR.
  • Stripped the temporary "ECR push is intentionally disabled" notes from both file headers.

Test plan

🤖 Generated with Claude Code

Reverts the GHCR-only workaround from PR #507 now that the ECR repos
exist. posthog-cloud-infra#7848 merged and the aws-accnt-root apply ran
at 19:40 UTC, creating both `duckgres-worker` and `duckgres-controlplane`
in account 795637471508 along with their cross-account pull policies.

Restores in both workflows:
- ECR_REGISTRY env var
- aws-actions/configure-aws-credentials + amazon-ecr-login steps in
  build and manifest jobs
- ECR tags in the docker/build-push-action tags list (so per-arch images
  push to both ECR and GHCR)
- ECR docker buildx imagetools create calls in manifest assembly
- For the worker default-version case, retag both ECR <sha>/latest and
  GHCR <sha>/latest

Strips the temporary "ECR push is intentionally disabled" notes from
both file headers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@fuziontech fuziontech merged commit d690a78 into main May 1, 2026
22 checks passed
@fuziontech fuziontech deleted the feat/ci-reenable-ecr-push branch May 1, 2026 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant