From 9cdc19aafcef44ca768841428503d7c13e79cf6b Mon Sep 17 00:00:00 2001 From: mamundsen-specter Date: Wed, 9 Sep 2026 22:16:18 -0700 Subject: [PATCH 1/5] feat: add ecr registry, generate metadata tags --- .../workflows/build-and-sign-container.yml | 42 ++++++++++++------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-and-sign-container.yml b/.github/workflows/build-and-sign-container.yml index 738ee31f..41c5b307 100644 --- a/.github/workflows/build-and-sign-container.yml +++ b/.github/workflows/build-and-sign-container.yml @@ -62,20 +62,21 @@ jobs: echo "clean_version=$CLEAN_VERSION" >> "$GITHUB_OUTPUT" echo "version_tag=$VERSION_TAG" >> "$GITHUB_OUTPUT" - - name: Set image tags - id: image-tags - run: | - TAGS="${{ steps.image-ref.outputs.version_tag }}" - - if [ "${{ inputs.prerelease }}" != "true" ] && [ -n "${{ matrix.latest_tag }}" ]; then - TAGS="${TAGS}"$'\n'"${DOCKER_REGISTRY}/${DOCKER_REPOSITORY}:${{ matrix.latest_tag }}" - fi - - { - echo "tags<> "$GITHUB_OUTPUT" + - name: Generate Metadata + id: metadata + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5 + with: + images: | + ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }} + ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY }} + tags: | + # prerelease + type=raw,value=${{ steps.image-ref.outputs.clean_version }},suffix=${{ matrix.suffix }},enable=${{ inputs.prerelease }} + type=sha,format=short,prefix=prerelease-,suffix=${{ matrix.suffix }},enable=${{ inputs.prerelease }} + # release + type=raw,value=${{ steps.image-ref.outputs.clean_version }},suffix=${{ matrix.suffix }},enable=${{ ! inputs.prerelease }} + type=raw,value=${{ matrix.latest_tag }},enable=${{ ! inputs.prerelease }} + type=sha,format=short,prefix=release-,suffix=${{ matrix.suffix }},enable=${{ ! inputs.prerelease }} - name: Set up QEMU uses: docker/setup-qemu-action@v4 @@ -83,6 +84,17 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # ratchet:aws-actions/configure-aws-credentials@v6 + with: + aws-access-key-id: ${{ secrets.BHE_AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.BHE_AWS_SECRET_ACCESS_KEY }} + aws-region: 'us-east-1' + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # ratchet:aws-actions/amazon-ecr-login@v2 + - name: Login to Docker registry run: | echo "$DOCKER_PASSWORD" | docker login "$DOCKER_REGISTRY" -u "$DOCKER_USERNAME" --password-stdin @@ -97,7 +109,7 @@ jobs: platforms: linux/amd64,linux/arm64 push: true sbom: true - tags: ${{ steps.image-tags.outputs.tags }} + tags: ${{ steps.metadata.outputs.tags }} build-args: | OPENHOUND_VERSION=${{ steps.image-ref.outputs.clean_version }} From f3a417a9499465197b3d080bb657c4da4a7fbd9a Mon Sep 17 00:00:00 2001 From: mamundsen-specter Date: Mon, 14 Sep 2026 17:01:07 -0700 Subject: [PATCH 2/5] add build-ecr-manual.yaml --- .github/workflows/build-ecr-manual.yaml | 73 +++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .github/workflows/build-ecr-manual.yaml diff --git a/.github/workflows/build-ecr-manual.yaml b/.github/workflows/build-ecr-manual.yaml new file mode 100644 index 00000000..c0db29ab --- /dev/null +++ b/.github/workflows/build-ecr-manual.yaml @@ -0,0 +1,73 @@ +name: Build image for ECR +on: + workflow_dispatch: + inputs: + tag: + description: "Tag to use for building container image" + required: true + type: string + +permissions: + contents: read + id-token: write + +jobs: + push-to-ECR-registry: + name: Push Image to Docker Registry (${{ matrix.target }}) + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate Metadata + id: metadata + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5 + with: + images: | + ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }} + tags: | + type=raw,prefix=ecr-,value=${{ inputs.tag }},enable=true + type=sha,format=short,prefix=ecr-,enable=true + + - name: Set up QEMU + uses: docker/setup-qemu-action@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # ratchet:aws-actions/configure-aws-credentials@v6 + with: + aws-access-key-id: ${{ secrets.BHE_AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.BHE_AWS_SECRET_ACCESS_KEY }} + aws-region: 'us-east-1' + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # ratchet:aws-actions/amazon-ecr-login@v2 + + - name: Build and push multi-arch image + id: push + uses: docker/build-push-action@v7 + with: + context: . + file: ./Dockerfile + target: ${{ matrix.target }} + platforms: linux/amd64,linux/arm64 + push: true + sbom: true + tags: ${{ steps.metadata.outputs.tags }} + build-args: | + OPENHOUND_VERSION=${{ steps.image-ref.outputs.clean_version }} + + - name: Persist digest + run: | + echo "${{ steps.push.outputs.digest }}" > "${{ runner.temp }}/digest-${{ matrix.target }}.txt" + + - name: Upload digest artifact + uses: actions/upload-artifact@v4 + with: + name: docker-digest-${{ matrix.target }} + path: ${{ runner.temp }}/digest-${{ matrix.target }}.txt + if-no-files-found: error + retention-days: 7 From a16ffabf97d91a95c570ba4cb080db4f2c4d148a Mon Sep 17 00:00:00 2001 From: mamundsen-specter Date: Mon, 14 Sep 2026 17:12:16 -0700 Subject: [PATCH 3/5] remove persist/upload digest steps, update target --- .github/workflows/build-ecr-manual.yaml | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-ecr-manual.yaml b/.github/workflows/build-ecr-manual.yaml index c0db29ab..234ad72d 100644 --- a/.github/workflows/build-ecr-manual.yaml +++ b/.github/workflows/build-ecr-manual.yaml @@ -6,6 +6,10 @@ on: description: "Tag to use for building container image" required: true type: string + target: + description: "Dockerfile target for building (enterprise, cli, base)" + required: true + type: string permissions: contents: read @@ -13,7 +17,7 @@ permissions: jobs: push-to-ECR-registry: - name: Push Image to Docker Registry (${{ matrix.target }}) + name: Push Image to Docker Registry (${{ inputs.target }}) runs-on: ubuntu-latest steps: - name: Checkout @@ -52,22 +56,10 @@ jobs: with: context: . file: ./Dockerfile - target: ${{ matrix.target }} + target: ${{ inputs.target }} platforms: linux/amd64,linux/arm64 push: true sbom: true tags: ${{ steps.metadata.outputs.tags }} build-args: | - OPENHOUND_VERSION=${{ steps.image-ref.outputs.clean_version }} - - - name: Persist digest - run: | - echo "${{ steps.push.outputs.digest }}" > "${{ runner.temp }}/digest-${{ matrix.target }}.txt" - - - name: Upload digest artifact - uses: actions/upload-artifact@v4 - with: - name: docker-digest-${{ matrix.target }} - path: ${{ runner.temp }}/digest-${{ matrix.target }}.txt - if-no-files-found: error - retention-days: 7 + OPENHOUND_VERSION=${{ inputs.target }} From 6a8f17ce731249bf93bab7e21939e1a19ca4826c Mon Sep 17 00:00:00 2001 From: mamundsen-specter Date: Mon, 14 Sep 2026 17:22:52 -0700 Subject: [PATCH 4/5] fix env tag --- .github/workflows/build-ecr-manual.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-ecr-manual.yaml b/.github/workflows/build-ecr-manual.yaml index 234ad72d..bfcf25ad 100644 --- a/.github/workflows/build-ecr-manual.yaml +++ b/.github/workflows/build-ecr-manual.yaml @@ -62,4 +62,4 @@ jobs: sbom: true tags: ${{ steps.metadata.outputs.tags }} build-args: | - OPENHOUND_VERSION=${{ inputs.target }} + OPENHOUND_VERSION=${{ inputs.tag }} From a73142ae0e8d228ca8c401ee37275839a907337c Mon Sep 17 00:00:00 2001 From: mamundsen-specter Date: Mon, 14 Sep 2026 17:35:53 -0700 Subject: [PATCH 5/5] add target input tag prefix --- .github/workflows/build-ecr-manual.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-ecr-manual.yaml b/.github/workflows/build-ecr-manual.yaml index bfcf25ad..cbd2e4bb 100644 --- a/.github/workflows/build-ecr-manual.yaml +++ b/.github/workflows/build-ecr-manual.yaml @@ -30,8 +30,8 @@ jobs: images: | ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }} tags: | - type=raw,prefix=ecr-,value=${{ inputs.tag }},enable=true - type=sha,format=short,prefix=ecr-,enable=true + type=raw,prefix=ecr-${{ inputs.target }},value=${{ inputs.tag }},enable=true + type=sha,format=short,prefix=ecr-${{ inputs.target }},enable=true - name: Set up QEMU uses: docker/setup-qemu-action@v4