Conversation
0ba19e2 to
91c402f
Compare
2b35bab to
a17ab22
Compare
…y credentials are provided
454fbd2 to
450aacf
Compare
450aacf to
bc406e0
Compare
| // If using the ECR docker credential helper, need to ensure that these environment variables | ||
| // are present in the shell of the docker pull command. | ||
| const containerPullCliEnvs = new Set([ | ||
| 'AWS_PROFILE', | ||
| 'AWS_ACCESS_KEY_ID', | ||
| 'AWS_SECRET_ACCESS_KEY', | ||
| 'AWS_STS_REGIONAL_ENDPOINTS', | ||
| 'AWS_DEFAULT_REGION', | ||
| 'AWS_REGION', | ||
| 'AWS_ROLE_ARN', | ||
| 'AWS_WEB_IDENTITY_TOKEN_FILE', | ||
| 'HOME', | ||
| 'PATH' | ||
| ]) |
There was a problem hiding this comment.
As mentioned in the code comment, we need these environment variables present in the shell the runner exec uses to run our hook, in order for our hook/docker to properly use the Credential Helper.
There was a problem hiding this comment.
Will these be automatically filtered out from the output?
There was a problem hiding this comment.
Per our discussion, added functionality in eddfa91 to ensure the values of these env vars get obfuscated if they're ever present in log output!
| } | ||
| } | ||
| // Explicitly set GITHUB_ACTIONS and CI env vars on the container | ||
| dockerArgs.push('-e', 'GITHUB_ACTIONS', '-e', 'CI') |
There was a problem hiding this comment.
GitHub's Runner does this, and we depend on these being set inside the Job container, so incorporating that here on container creation (the env variables are passed to the docker command in https://github.com/wrapbook/runner-container-hooks/pull/1/files#diff-a01582fa233588888b956b55c88cb9118fb5a841a129372a3e84961890ee5b33R48-R50)
2477dbf to
eddfa91
Compare
To support replacing ECR Login Credentials with amazon-ecr-credential-helper in our CI workflows, this customizes the Docker
prepare_jobHook to skip thedocker loginstep and "fallback" to a default docker config location if no registry credentials are provided to the Hook, i.e. thecontainer.credentialsare not provided.Additional changes of note:
AWS_vars)GITHUB_ACTIONSandCIenvironment variables to the container on creation (necessary for some of our internal logic/handling)PR
#2aof Using Docker Credential Helpers for ECR Registries in GitHub Actionssc-135780