From 3ab6c797133b5eb2ed67327d9b515d492d090be1 Mon Sep 17 00:00:00 2001 From: Forrest Loomis Date: Mon, 15 Jun 2026 14:05:08 -0400 Subject: [PATCH 1/2] ci: adopt docker/actions/build-push-image-ecr Replace the hand-rolled Docker Hub login / Buildx / configure-aws-credentials / ECR login / build-push steps with the shared build-push-image-ecr action. The previous workflow assumed the IAM role CicdEnvoy-... in account 710015040892, but that role's Terraform was removed (infra-terraform #9725) in favor of the self-serve shared-ECR setup. The action derives the live release-envoy role and pushes to the shared ECR (676043725699/images/envoy/envoy), which is the onboarded path for this repo. This also fixes a latent bug: the old build-push step had push disabled (# push: true commented out), so the "release" never actually published. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build-and-release.yaml | 46 +++++------------------- 1 file changed, 9 insertions(+), 37 deletions(-) diff --git a/.github/workflows/build-and-release.yaml b/.github/workflows/build-and-release.yaml index cb14c8cf5b7c7..e8ef8e8146936 100644 --- a/.github/workflows/build-and-release.yaml +++ b/.github/workflows/build-and-release.yaml @@ -12,52 +12,24 @@ permissions: jobs: build-and-push: runs-on: ubuntu-latest - + steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: fetch-depth: 0 - - name: Login to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 - with: - # Stopgap: DOCKERBUILDBOT_READ_PAT is not yet shared with docker/envoy. - # dockerpublicbot's read PAT is already available as an org secret here. - # Revert to dockerbuildbot once the org secret access is granted. - username: dockerpublicbot - password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - with: - driver: cloud - endpoint: docker/platform-experience - install: true - - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0 - with: - role-to-assume: "arn:aws:iam::710015040892:role/CicdEnvoy-20251021161123163100000002" - role-session-name: EnvoyCI - aws-region: us-east-1 - - - name: Login to ECR - run: | - aws ecr get-login-password | docker login --username AWS --password-stdin 710015040892.dkr.ecr.us-east-1.amazonaws.com - - name: Get Current Git SHA id: git_sha run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - name: Build and Push Docker Image - id: docker-build - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + - name: Build and push to ECR + uses: docker/actions/build-push-image-ecr@b23a287c41a8de3106eaf4ed333465a62dc1a9f7 # main with: - context: . + image_name: envoy + image_version: ${{ steps.git_sha.outputs.sha }} + target: envoy-distroless platforms: linux/amd64 - # push: true - build-args: | + build_args: | VERSION=${{ steps.git_sha.outputs.sha }} - tags: | - 710015040892.dkr.ecr.us-east-1.amazonaws.com/infra-routing/envoy:${{ steps.git_sha.outputs.sha }} - + docker_username: dockerpublicbot + docker_password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }} From f72aa58f58f3c8dc3d4e4eb68f5189f2c2cd8627 Mon Sep 17 00:00:00 2001 From: Forrest Loomis Date: Mon, 15 Jun 2026 14:08:21 -0400 Subject: [PATCH 2/2] ci: tag image as 1.38.2- Use the release version prefix with the short commit SHA for the image tag (e.g. 1.38.2-3ab6c79) instead of the bare full SHA. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build-and-release.yaml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-and-release.yaml b/.github/workflows/build-and-release.yaml index e8ef8e8146936..697eefa565231 100644 --- a/.github/workflows/build-and-release.yaml +++ b/.github/workflows/build-and-release.yaml @@ -18,18 +18,20 @@ jobs: with: fetch-depth: 0 - - name: Get Current Git SHA - id: git_sha - run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + - name: Compute image version + id: version + run: | + echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + echo "version=1.38.2-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" - name: Build and push to ECR uses: docker/actions/build-push-image-ecr@b23a287c41a8de3106eaf4ed333465a62dc1a9f7 # main with: image_name: envoy - image_version: ${{ steps.git_sha.outputs.sha }} + image_version: ${{ steps.version.outputs.version }} target: envoy-distroless platforms: linux/amd64 build_args: | - VERSION=${{ steps.git_sha.outputs.sha }} + VERSION=${{ steps.version.outputs.sha }} docker_username: dockerpublicbot docker_password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}