From fc3f3e25f3e3dc0012d8407e7cad147f802e7831 Mon Sep 17 00:00:00 2001
From: Thomas Piccirello <tom.p@posthog.com>
Date: Fri, 31 Jul 2026 14:23:36 -0700
Subject: [PATCH] ci: publish e2e/scenario test images to the duckgres-prs ECR
 repo

e2e-mw-dev and scenario-dev push their test images (pr-<n>-<sha>,
scenario-runner-<run_id>-<attempt>, scenario-duckgres-<run_id>-<attempt>) into
the PROD duckgres ECR repo, which is why that repo has to keep a mutable pr-*
carve-out. Point them at the dedicated duckgres-prs repo instead, via the
any-ref github-duckgres-prs-publish-role (repo variable
AWS_ECR_PRS_PUBLISH_IAM_ROLE) rather than the shared org-secret role.

Downstream jobs consume needs.<job>.outputs.image (the full registry URL), so
the retarget propagates without further changes. The mw-dev cluster can pull
duckgres-prs: the -prs repos get the same cross-account read policy.

Requires the duckgres-prs repo + role from posthog-cloud-infra#9715 to be
applied, and the AWS_ECR_PRS_PUBLISH_IAM_ROLE variable set, before merging.
---
 .github/workflows/e2e-mw-dev.yml   | 4 ++--
 .github/workflows/scenario-dev.yml | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/e2e-mw-dev.yml b/.github/workflows/e2e-mw-dev.yml
index 68819495..57fd5bda 100644
--- a/.github/workflows/e2e-mw-dev.yml
+++ b/.github/workflows/e2e-mw-dev.yml
@@ -82,7 +82,7 @@ jobs:
     uses: ./.github/workflows/_image-build.yml
     with:
       dockerfile: Dockerfile
-      image-name: duckgres
+      image-name: duckgres-prs
       tag: pr-${{ github.event.pull_request.number || github.run_id }}-${{ github.sha }}-arm64
       platform: linux/arm64
       cache-scope: e2e-duckgres-arm64
@@ -95,7 +95,7 @@ jobs:
         DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org
         POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org
     secrets:
-      ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
+      ecr-role: ${{ vars.AWS_ECR_PRS_PUBLISH_IAM_ROLE }}
 
   e2e_lanes:
     needs: [build]
diff --git a/.github/workflows/scenario-dev.yml b/.github/workflows/scenario-dev.yml
index b9491a44..fbdbbd7f 100644
--- a/.github/workflows/scenario-dev.yml
+++ b/.github/workflows/scenario-dev.yml
@@ -29,19 +29,19 @@ jobs:
     uses: ./.github/workflows/_image-build.yml
     with:
       dockerfile: tests/mw-dev/scenario/Dockerfile
-      image-name: duckgres
+      image-name: duckgres-prs
       tag: scenario-runner-${{ github.run_id }}-${{ github.run_attempt }}-arm64
       platform: linux/arm64
       cache-scope: scenario-runner-arm64
     secrets:
-      ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
+      ecr-role: ${{ vars.AWS_ECR_PRS_PUBLISH_IAM_ROLE }}
 
   duckgres-image:
     if: ${{ github.event_name != 'workflow_dispatch' || inputs.duckgres_image == '' }}
     uses: ./.github/workflows/_image-build.yml
     with:
       dockerfile: Dockerfile
-      image-name: duckgres
+      image-name: duckgres-prs
       tag: scenario-duckgres-${{ github.run_id }}-${{ github.run_attempt }}-arm64
       platform: linux/arm64
       cache-scope: scenario-duckgres-arm64
@@ -52,7 +52,7 @@ jobs:
         DUCKDB_EXTENSION_REPOSITORY=https://extensions.duckdb.org
         POSTGRES_SCANNER_REPOSITORY=https://extensions.duckdb.org
     secrets:
-      ecr-role: ${{ secrets.AWS_ECR_PUBLISH_IAM_ROLE }}
+      ecr-role: ${{ vars.AWS_ECR_PRS_PUBLISH_IAM_ROLE }}
 
   scenario:
     needs: [scenario-runner-image, duckgres-image]