ci: use the dedicated per-repo ECR publish role - #1011
Merged
Conversation
Points this repo's ECR publish at its own least-privilege role via the repo variable `AWS_ECR_PUBLISH_IAM_ROLE` (set to `arn:aws:iam::795637471508:role/github-<repo>-publish-role`), instead of the shared `github-posthog-ecr-publish-role`. Part of splitting the shared role (which trusts ~18 repos on `resource:*`) into per-repo roles scoped to only each repo's own images and refs. The variable is already set; merging this completes the cutover.
Test Impact PlanDeterministic summary of how this PR changes tests, CI runners, and coverage-risk signals. Summary
Signals
Coverage risk: neutral or increased No coverage-reduction warnings detected. |
e2e-mw-dev and scenario-dev push test images to root ECR on PRs/dispatch via _image-build.yml. The dedicated github-duckgres-publish-role is main-only, so they must keep using the shared role (any-ref trust) for now. Only the container-image-*-cd.yml prod pushers migrate to the per-repo role here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates duckgres's prod image pushers (the four
container-image-*-cd.ymlCD workflows) off the sharedgithub-posthog-ecr-publish-roleto the dedicated main-onlygithub-duckgres-publish-role, referenced via the repo variableAWS_ECR_PUBLISH_IAM_ROLE.e2e-mw-dev.ymlandscenario-dev.ymlpush test images to root ECR on PRs/dispatch via_image-build.yml; the dedicated role is main-only, so those intentionally stay on the shared role for now (they need an any-ref role — a follow-up, same-prs-style decision as charts/housekeeper). So this is a partial cutover: duckgres stays in the shared role's trust until the test workflows are handled.Part of splitting the shared role (trusts ~18 repos on
resource:*) into per-repo least-privilege roles. The variable is already set.