Merge pull request #82 from DataDog/publish-to-ghcr

[TRAIN-2677] Switch container image registry target from ECR to GHCR
DataDog · Jan 31, 2025 · 7d20564 · 7d20564
2 parents 88a5ddc + 8fee2a9
commit 7d20564
Show file tree

Hide file tree

Showing 11 changed files with 110 additions and 86 deletions.
diff --git a/.github/workflows/ads-java.yml b/.github/workflows/ads-java.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/ads/java/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,19 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/ads/java
         platforms: linux/amd64,linux/arm64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/ads-java:latest
+        tags: ghcr.io/DataDog/storedog/ads-java:latest
 
diff --git a/.github/workflows/ads.yml b/.github/workflows/ads.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/ads/python/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,19 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/ads/python
         platforms: linux/amd64,linux/arm64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/ads:latest
+        tags: ghcr.io/DataDog/storedog/ads:latest
 
diff --git a/.github/workflows/attackbox.yml b/.github/workflows/attackbox.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/attackbox/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,19 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/attackbox
         platforms: linux/amd64,linux/arm64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/attackbox:latest
+        tags: ghcr.io/DataDog/storedog/attackbox:latest
 
diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/auth/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
       - name: Checkout
@@ -27,19 +29,19 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to ECR
-        id: login-ecr
+      - name: Login to GHCR
+        id: login-ghcr
         uses: docker/login-action@v3
         with:
-          registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: ./services/auth
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/auth:latest
+          tags: ghcr.io/DataDog/storedog/auth:latest
 
diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/backend/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,19 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/backend
         platforms: linux/amd64,linux/arm64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/backend:latest
+        tags: ghcr.io/DataDog/storedog/backend:latest
 
diff --git a/.github/workflows/dbm.yml b/.github/workflows/dbm.yml
@@ -8,17 +8,20 @@ on:
     paths:
       - services/dbm/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
     working-directory: dbm
 
+
 jobs:
 
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
       - name: Checkout
@@ -27,19 +30,19 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to ECR
-        id: login-ecr
+      - name: Login to GHCR
+        id: login-ghcr
         uses: docker/login-action@v3
         with:
-          registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: ./services/dbm
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/dbm:latest
+          tags: ghcr.io/DataDog/storedog/dbm:latest
 
diff --git a/.github/workflows/discounts.yml b/.github/workflows/discounts.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/discounts/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,18 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/discounts
         platforms: linux/amd64,linux/arm64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/discounts:latest
-
+        tags: ghcr.io/DataDog/storedog/discounts:latest
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/frontend/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
     - name: Checkout
@@ -27,19 +29,19 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Login to ECR
-      id: login-ecr
+    - name: Login to GHCR
+      id: login-ghcr
       uses: docker/login-action@v3
       with:
-        registry: public.ecr.aws
-        username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
         context: ./services/frontend
         platforms: linux/arm64, linux/amd64
         push: true
-        tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/frontend:latest
+        tags: ghcr.io/DataDog/storedog/frontend:latest
 
diff --git a/.github/workflows/nginx.yml b/.github/workflows/nginx.yml
@@ -8,7 +8,6 @@ on:
     paths:
       - services/nginx/**
   workflow_dispatch:
-    branches: [ main ]
 
 defaults:
   run:
@@ -19,6 +18,9 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
 
     steps:
       - name: Checkout
@@ -27,19 +29,19 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to ECR
-        id: login-ecr
+      - name: Login to GHCR
+        id: login-ghcr
         uses: docker/login-action@v3
         with:
-          registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: ./services/nginx
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ secrets.PUBLIC_ECR_REGISTRY }}/storedog/nginx:latest
+          tags: ghcr.io/DataDog/storedog/nginx:latest