FilesExpand file tree

develop

/

mirror-slim-image.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

187 lines (174 loc) · 7.74 KB

develop

/

mirror-slim-image.yml

Copy path

Top

File metadata and controls

• Code
• Blame

187 lines (174 loc) · 7.74 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

name: Mirror Slim Image

# Mirrors slim service images published by supabase/slim-services from ghcr.io/supabase/cli to

# public.ecr.aws/supabase/cli. The sender polls the ECR Public destination and fails its release

# unless it resolves to the exact index digest published, so the copy must be digest-preserving

# via `regctl image copy` (byte-for-byte); do not switch to `docker buildx imagetools create`,

# which can rewrite the index and change its digest.

#

# The payload arrives with whatever authority holds the dispatch token, so it is treated as

# untrusted: names are pattern-checked, source/destination are derived here rather than trusted

# from the payload, and the source must resolve to the claimed digest before anything is copied.

#

# Full contract: docs/design/ecr-mirror-dispatch.md in supabase/slim-services.

on:

repository_dispatch:

types:

- mirror-slim-image

workflow_dispatch:

inputs:

service:

description: "Service name (e.g. postgrest)"

required: true

type: string

version:

description: "Image tag (e.g. v16.2)"

required: true

type: string

digest:

description: "Expected index digest (sha256:<64 hex chars>)"

required: true

type: string

permissions:

contents: read

concurrency:

group: mirror-slim-image-${{ github.event.client_payload.service || inputs.service }}-${{ github.event.client_payload.version || inputs.version }}

cancel-in-progress: false

jobs:

mirror:

runs-on: ubuntu-latest

# The sender's poll times out after 15 minutes; fail fast instead of

# hanging past that window.

timeout-minutes: 10

permissions:

contents: read

packages: read

id-token: write

steps:

- name: Validate payload

id: validate

env:

EVENT_NAME: ${{ github.event_name }}

SERVICE: ${{ github.event.client_payload.service || inputs.service }}

VERSION: ${{ github.event.client_payload.version || inputs.version }}

DIGEST: ${{ github.event.client_payload.digest || inputs.digest }}

PAYLOAD_SOURCE: ${{ github.event.client_payload.source }}

PAYLOAD_DESTINATION: ${{ github.event.client_payload.destination }}

run: |

set -euo pipefail

if [[ ! "$SERVICE" =~ ^[a-z][a-z0-9-]*$ ]]; then

echo "::error::invalid service name: '$SERVICE'"

exit 1

fi

if [[ ! "$VERSION" =~ ^[A-Za-z0-9._-]+$ ]]; then

echo "::error::invalid version: '$VERSION'"

exit 1

fi

if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then

echo "::error::invalid digest: '$DIGEST'"

exit 1

fi

SOURCE="ghcr.io/supabase/cli/${SERVICE}:${VERSION}"

DESTINATION="public.ecr.aws/supabase/cli/${SERVICE}:${VERSION}"

# Never trust the payload's source/destination strings; require them

# to match the values derived from service + version.

if [ "$EVENT_NAME" = "repository_dispatch" ]; then

if [ "$PAYLOAD_SOURCE" != "$SOURCE" ]; then

echo "::error::payload source '$PAYLOAD_SOURCE' does not match derived '$SOURCE'"

exit 1

fi

if [ "$PAYLOAD_DESTINATION" != "$DESTINATION" ]; then

echo "::error::payload destination '$PAYLOAD_DESTINATION' does not match derived '$DESTINATION'"

exit 1

fi

fi

{

echo "service=$SERVICE"

echo "source=$SOURCE"

echo "destination=$DESTINATION"

echo "digest=$DIGEST"

} >> "$GITHUB_OUTPUT"

- name: Install regctl

# $RUNNER_TEMP is always writable by the job user.

run: |

set -euo pipefail

install -d "${RUNNER_TEMP}/regctl-bin"

curl -fsSLo "${RUNNER_TEMP}/regctl-bin/regctl" \

https://github.com/regclient/regclient/releases/download/v0.11.5/regctl-linux-amd64

echo "c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467 ${RUNNER_TEMP}/regctl-bin/regctl" | sha256sum -c -

chmod +x "${RUNNER_TEMP}/regctl-bin/regctl"

echo "${RUNNER_TEMP}/regctl-bin" >> "$GITHUB_PATH"

"${RUNNER_TEMP}/regctl-bin/regctl" version

- name: Log in to ghcr.io

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- name: Verify source digest

env:

SOURCE: ${{ steps.validate.outputs.source }}

DIGEST: ${{ steps.validate.outputs.digest }}

run: |

set -euo pipefail

SOURCE_DIGEST="$(regctl manifest head "$SOURCE")"

if [ "$SOURCE_DIGEST" != "$DIGEST" ]; then

echo "::error::source $SOURCE resolves to $SOURCE_DIGEST, expected $DIGEST"

exit 1

fi

- name: Configure aws credentials

uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4

with:

role-to-assume: ${{ secrets.PROD_AWS_ROLE }}

aws-region: us-east-1

- name: Log in to ECR Public

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

with:

registry: public.ecr.aws

- name: Ensure ECR Public repository exists

env:

SERVICE: ${{ steps.validate.outputs.service }}

run: |

set -euo pipefail

REPO_NAME="cli/${SERVICE}"

if aws ecr-public describe-repositories \

--repository-names "$REPO_NAME" --region us-east-1 >/dev/null 2>&1; then

echo "ECR Public repository $REPO_NAME exists"

exit 0

fi

if CREATE_ERR="$(aws ecr-public create-repository \

--repository-name "$REPO_NAME" --region us-east-1 2>&1 >/dev/null)"; then

echo "created ECR Public repository $REPO_NAME"

elif grep -q RepositoryAlreadyExistsException <<< "$CREATE_ERR"; then

# Concurrent run for another version of the same new service won

# the creation race; the repository exists, which is all we need.

echo "ECR Public repository $REPO_NAME was created concurrently"

else

echo "$CREATE_ERR"

echo "::error::ECR Public repository '$REPO_NAME' does not exist and this role cannot create it (missing ecr-public:CreateRepository). Create it once manually — aws ecr-public create-repository --repository-name '$REPO_NAME' --region us-east-1 — then re-run this workflow."

exit 1

fi

- name: Mirror image

env:

SOURCE: ${{ steps.validate.outputs.source }}

DESTINATION: ${{ steps.validate.outputs.destination }}

DIGEST: ${{ steps.validate.outputs.digest }}

# Copies by digest (not tag) so it can't race a tag move on the source, and runs

# unconditionally with no early exit: regctl's copy is incremental, so re-dispatching

# after a complete copy is a cheap no-op, and after a partial failure it finishes the

# copy instead of skipping it.

run: |

set -euo pipefail

regctl image copy --referrers --digest-tags \

"${SOURCE%:*}@${DIGEST}" "$DESTINATION"

- name: Verify destination digest

env:

DESTINATION: ${{ steps.validate.outputs.destination }}

DIGEST: ${{ steps.validate.outputs.digest }}

run: |

set -euo pipefail

DEST_DIGEST="$(regctl manifest head "$DESTINATION")"

if [ "$DEST_DIGEST" != "$DIGEST" ]; then

echo "::error::destination $DESTINATION resolves to $DEST_DIGEST, expected $DIGEST"

exit 1

fi

echo "$DESTINATION resolves to $DIGEST"