test registry identities with ECR

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

Author: crazy-max

.github/workflows/.test-bake.yml

@@ -16,12 +16,14 @@ on:
     paths:
       - '.github/workflows/.test-bake.yml'
       - '.github/workflows/bake.yml'
+      - '.github/workflows/registry-identities.yml'
       - '.github/workflows/verify.yml'
       - 'test/**'
   pull_request:
     paths:
       - '.github/workflows/.test-bake.yml'
       - '.github/workflows/bake.yml'
+      - '.github/workflows/registry-identities.yml'
       - '.github/workflows/verify.yml'
       - 'test/**'
 
@@ -79,6 +81,54 @@ jobs:
             const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
             core.info(JSON.stringify(builderOutputs, null, 2));
 
+  bake-ecr-public:
+    uses: ./.github/workflows/bake.yml
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      context: test
+      output: image
+      push: true
+      sbom: true
+      set: |
+        *.args.VERSION={{meta.version}}
+      target: hello
+      registry-identities: |
+        - type: aws-ecr
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+          registry: public.ecr.aws
+      meta-images: |
+        public.ecr.aws/q3b5f1u4/test-docker-action
+      meta-tags: |
+        type=raw,value=bake-ecr-public-${{ github.run_id }}
+
+  bake-ecr-private:
+    uses: ./.github/workflows/bake.yml
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      context: test
+      output: image
+      push: true
+      sbom: true
+      set: |
+        *.args.VERSION={{meta.version}}
+      target: hello
+      registry-identities: |
+        - type: aws-ecr
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+          registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
+      meta-images: |
+        175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
+      meta-tags: |
+        type=raw,value=bake-ecr-private-${{ github.run_id }}
+
   bake-dockerhub:
     uses: ./.github/workflows/bake.yml
     permissions:

.github/workflows/.test-build.yml

@@ -16,12 +16,14 @@ on:
     paths:
       - '.github/workflows/.test-build.yml'
       - '.github/workflows/build.yml'
+      - '.github/workflows/registry-identities.yml'
       - '.github/workflows/verify.yml'
       - 'test/**'
   pull_request:
     paths:
       - '.github/workflows/.test-build.yml'
       - '.github/workflows/build.yml'
+      - '.github/workflows/registry-identities.yml'
       - '.github/workflows/verify.yml'
       - 'test/**'
 
@@ -78,6 +80,52 @@ jobs:
             const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
             core.info(JSON.stringify(builderOutputs, null, 2));
 
+  build-ecr-public:
+    uses: ./.github/workflows/build.yml
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      build-args: |
+        VERSION={{meta.version}}
+      file: test/hello.Dockerfile
+      output: image
+      push: true
+      sbom: true
+      registry-identities: |
+        - type: aws-ecr
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+          registry: public.ecr.aws
+      meta-images: |
+        public.ecr.aws/q3b5f1u4/test-docker-action
+      meta-tags: |
+        type=raw,value=build-ecr-public-${{ github.run_id }}
+
+  build-ecr-private:
+    uses: ./.github/workflows/build.yml
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      build-args: |
+        VERSION={{meta.version}}
+      file: test/hello.Dockerfile
+      output: image
+      push: true
+      sbom: true
+      registry-identities: |
+        - type: aws-ecr
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
+          registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
+      meta-images: |
+        175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
+      meta-tags: |
+        type=raw,value=build-ecr-private-${{ github.run_id }}
+
   build-dockerhub:
     uses: ./.github/workflows/build.yml
     permissions: