From cbdafc686b36dafa951ac1bb4d4795ea2d839644 Mon Sep 17 00:00:00 2001 From: Thomas Piccirello Date: Wed, 29 Jul 2026 22:05:33 -0700 Subject: [PATCH 1/2] ci: use the dedicated per-repo ECR publish role Points this repo's ECR publish at its own least-privilege role via the repo variable `AWS_ECR_PUBLISH_IAM_ROLE` (set to `arn:aws:iam::795637471508:role/github--publish-role`), instead of the shared `github-posthog-ecr-publish-role`. Part of splitting the shared role (which trusts ~18 repos on `resource:*`) into per-repo roles scoped to only each repo's own images and refs. The variable is already set; merging this completes the cutover. --- .github/workflows/container-image-cache-proxy-cd.yml | 2 +- .github/workflows/container-image-cd.yml | 4 ++-- .github/workflows/container-image-controlplane-cd.yml | 4 ++-- .github/workflows/container-image-worker-cd.yml | 4 ++-- .github/workflows/e2e-mw-dev.yml | 2 +- .github/workflows/scenario-dev.yml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/container-image-cache-proxy-cd.yml b/.github/workflows/container-image-cache-proxy-cd.yml index e85aa564..7f6c11a8 100644 --- a/.github/workflows/container-image-cache-proxy-cd.yml +++ b/.github/workflows/container-image-cache-proxy-cd.yml @@ -34,7 +34,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR diff --git a/.github/workflows/container-image-cd.yml b/.github/workflows/container-image-cd.yml index 1b96ead3..8c2a7008 100644 --- a/.github/workflows/container-image-cd.yml +++ b/.github/workflows/container-image-cd.yml @@ -39,7 +39,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR @@ -118,7 +118,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR diff --git a/.github/workflows/container-image-controlplane-cd.yml b/.github/workflows/container-image-controlplane-cd.yml index c3250221..3c07925e 100644 --- a/.github/workflows/container-image-controlplane-cd.yml +++ b/.github/workflows/container-image-controlplane-cd.yml @@ -44,7 +44,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR @@ -155,7 +155,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR diff --git a/.github/workflows/container-image-worker-cd.yml b/.github/workflows/container-image-worker-cd.yml index 5cc15842..08d3e741 100644 --- a/.github/workflows/container-image-worker-cd.yml +++ b/.github/workflows/container-image-worker-cd.yml @@ -107,7 +107,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR @@ -279,7 +279,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 with: - role-to-assume: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + role-to-assume: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} aws-region: us-east-1 - name: Login to Amazon ECR diff --git a/.github/workflows/e2e-mw-dev.yml b/.github/workflows/e2e-mw-dev.yml index 68819495..75928b6a 100644 --- a/.github/workflows/e2e-mw-dev.yml +++ b/.github/workflows/e2e-mw-dev.yml @@ -95,7 +95,7 @@ jobs: DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org secrets: - ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} e2e_lanes: needs: [build] diff --git a/.github/workflows/scenario-dev.yml b/.github/workflows/scenario-dev.yml index b9491a44..9f663bcd 100644 --- a/.github/workflows/scenario-dev.yml +++ b/.github/workflows/scenario-dev.yml @@ -34,7 +34,7 @@ jobs: platform: linux/arm64 cache-scope: scenario-runner-arm64 secrets: - ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} duckgres-image: if: ${{ github.event_name != 'workflow_dispatch' || inputs.duckgres_image == '' }} @@ -52,7 +52,7 @@ jobs: DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org secrets: - ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} scenario: needs: [scenario-runner-image, duckgres-image] From 1eddc1af8c568d6e4727061b980c3a0790f0092c Mon Sep 17 00:00:00 2001 From: Thomas Piccirello Date: Wed, 29 Jul 2026 22:08:05 -0700 Subject: [PATCH 2/2] Revert e2e/scenario workflows to the shared publish role e2e-mw-dev and scenario-dev push test images to root ECR on PRs/dispatch via _image-build.yml. The dedicated github-duckgres-publish-role is main-only, so they must keep using the shared role (any-ref trust) for now. Only the container-image-*-cd.yml prod pushers migrate to the per-repo role here. --- .github/workflows/e2e-mw-dev.yml | 2 +- .github/workflows/scenario-dev.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/e2e-mw-dev.yml b/.github/workflows/e2e-mw-dev.yml index 75928b6a..68819495 100644 --- a/.github/workflows/e2e-mw-dev.yml +++ b/.github/workflows/e2e-mw-dev.yml @@ -95,7 +95,7 @@ jobs: DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org secrets: - ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} e2e_lanes: needs: [build] diff --git a/.github/workflows/scenario-dev.yml b/.github/workflows/scenario-dev.yml index 9f663bcd..b9491a44 100644 --- a/.github/workflows/scenario-dev.yml +++ b/.github/workflows/scenario-dev.yml @@ -34,7 +34,7 @@ jobs: platform: linux/arm64 cache-scope: scenario-runner-arm64 secrets: - ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} duckgres-image: if: ${{ github.event_name != 'workflow_dispatch' || inputs.duckgres_image == '' }} @@ -52,7 +52,7 @@ jobs: DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org secrets: - ecr-role: ${{ vars.AWS_ECR_PUBLISH_IAM_ROLE }} + ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }} scenario: needs: [scenario-runner-image, duckgres-image]