FilesExpand file tree

develop

/

mirror-template-images.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

88 lines (79 loc) · 3.13 KB

develop

/

mirror-template-images.yml

Copy path

Top

File metadata and controls

• Code
• Blame

88 lines (79 loc) · 3.13 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

name: Mirror template images

# Keeps the ghcr.io/ECR mirror in sync with the image versions pinned in

# apps/cli/src/shared/services/Dockerfile, which `dockerfileServiceImages`

# parses as the single source of truth for local service images. When the

# Dockerfile changes on develop — most often via a merged catalog bump or

# hotfix PR from slim-release-published.yml, or a Dependabot `docker` bump for

# an upstream-only image — this workflow detects any tag that is not yet

# mirrored and backfills it the same way `cli-go-mirror-image.yml` does.

#

# It runs on `push` to develop (not on the PR) on purpose: mirroring needs the

# AWS role + packages:write, which a dependabot-triggered `pull_request` run

# cannot be granted, and we deliberately avoid `pull_request_target`. This

# backfill runs as soon as the bump lands on develop, repopulating ghcr.io/ECR

# so anyone pinning SUPABASE_INTERNAL_IMAGE_REGISTRY=ghcr.io doesn't inherit a

# `manifest unknown` failure. (No CI job pins that registry anymore -- the

# `cli-go-ci.yml` `Start` job that used to made it CI-observable was removed in

# CLI-1966 along with `internal/start`; this mirror now only serves users who

# opt into the mirror directly, and a mirroring failure no longer turns any

# check red.)

on:

push:

branches:

- develop

paths:

- apps/cli/src/shared/services/Dockerfile

workflow_dispatch:

permissions:

contents: read

concurrency:

group: mirror-template-images-${{ github.ref }}

cancel-in-progress: false

jobs:

detect:

name: Detect unmirrored images

runs-on: ubuntu-latest

permissions:

contents: read

packages: read

outputs:

missing: ${{ steps.detect.outputs.missing }}

steps:

- name: Checkout

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Setup

uses: ./.github/actions/setup

with:

dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}

- name: Log in to ghcr.io

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

# Parses the Dockerfile, checks each image against the mirror, and writes

# `missing=<json>` to $GITHUB_OUTPUT. Idempotent: already-mirrored images

# are skipped, so a re-run produces an empty list.

- name: Detect images missing from the mirror

id: detect

run: pnpm exec bun apps/cli/scripts/detect-unmirrored-images.ts

mirror:

name: Mirror image

needs: detect

if: needs.detect.outputs.missing != '' && needs.detect.outputs.missing != '[]'

permissions:

contents: read

packages: write

id-token: write

strategy:

fail-fast: false

matrix:

image: ${{ fromJson(needs.detect.outputs.missing) }}

# Reuse the existing mirror logic (docker.io -> public.ecr.aws + ghcr.io).

uses: ./.github/workflows/cli-go-mirror-image.yml

with:

image: ${{ matrix.image }}

secrets:

PROD_AWS_ROLE: ${{ secrets.PROD_AWS_ROLE }}