ci: publish e2e/scenario test images to the duckgres-prs ECR repo - #1021
Merged
Conversation
e2e-mw-dev and scenario-dev push their test images (pr-<n>-<sha>, scenario-runner-<run_id>-<attempt>, scenario-duckgres-<run_id>-<attempt>) into the PROD duckgres ECR repo, which is why that repo has to keep a mutable pr-* carve-out. Point them at the dedicated duckgres-prs repo instead, via the any-ref github-duckgres-prs-publish-role (repo variable AWS_ECR_PRS_PUBLISH_IAM_ROLE) rather than the shared org-secret role. Downstream jobs consume needs.<job>.outputs.image (the full registry URL), so the retarget propagates without further changes. The mw-dev cluster can pull duckgres-prs: the -prs repos get the same cross-account read policy. Requires the duckgres-prs repo + role from posthog-cloud-infra#9715 to be applied, and the AWS_ECR_PRS_PUBLISH_IAM_ROLE variable set, before merging.
Test Impact PlanDeterministic summary of how this PR changes tests, CI runners, and coverage-risk signals. Summary
Signals
Coverage risk: neutral or increased No coverage-reduction warnings detected. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the e2e/scenario test images out of the prod
duckgresECR repo and into a dedicatedduckgres-prsrepo, using a dedicated any-ref publish role instead of the shared org-secret one.Why
e2e-mw-dev.ymlandscenario-dev.ymlcurrently pushpr-<n>-<sha>/scenario-runner-<run_id>-<attempt>/scenario-duckgres-<run_id>-<attempt>into the prodduckgresrepo (via the reusable_image-build.yml). That is why the prod repo has to keep a mutablepr-*carve-out, and it means PR builds can write to a production image repo. These are also the last two workflows still using the sharedgithub-posthog-ecr-publish-role.What changes
Three call sites of
_image-build.yml:image-name: duckgres→duckgres-prsecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}→${{ vars.AWS_ECR_PRS_PUBLISH_IAM_ROLE }}_image-build.ymlitself is unchanged (already parameterised), and it is called only by these two workflows — the fourcontainer-image-*-cd.ymlprod pushers authenticate inline and are untouched.Downstream jobs consume
needs.<job>.outputs.image(the full registry URL), so the new repo propagates automatically. The mw-dev cluster can pullduckgres-prs— the-prsrepos get the same cross-account read policy as the prod ones.Depends on
posthog-cloud-infra#9715 (creates
duckgres-prs+github-duckgres-prs-publish-role) applied, and the repo variableAWS_ECR_PRS_PUBLISH_IAM_ROLEset. Merging before that will fail to assume the role.Once this lands, a follow-up infra PR flips the prod
duckgresrepo to fully immutable (droppingexclusions = ["pr-*"]).