image-copy-ecr: support immutable tags

image-copy-ecr/cmd/app/main.go

@@ -33,12 +33,13 @@ import (
 var amazonKeychain authn.Keychain = authn.NewKeychainFromHelper(ecrcreds.NewECRHelper(ecrcreds.WithLogger(log.Writer())))
 
 var env = struct {
-	Issuer      string `envconfig:"ISSUER_URL" required:"true"`
-	Group       string `envconfig:"GROUP" required:"true"`
-	Identity    string `envconfig:"IDENTITY" required:"true"`
-	Region      string `envconfig:"REGION" required:"true"`
-	DstRepo     string `envconfig:"DST_REPO" required:"true"`
-	FullDstRepo string `envconfig:"FULL_DST_REPO" required:"true"`
+	Issuer        string `envconfig:"ISSUER_URL" required:"true"`
+	Group         string `envconfig:"GROUP" required:"true"`
+	Identity      string `envconfig:"IDENTITY" required:"true"`
+	Region        string `envconfig:"REGION" required:"true"`
+	DstRepo       string `envconfig:"DST_REPO" required:"true"`
+	FullDstRepo   string `envconfig:"FULL_DST_REPO" required:"true"`
+	ImmutableTags bool   `envconfig:"IMMUTABLE_TAGS" required:"true"`
 }{}
 
 func init() {
@@ -104,11 +105,16 @@ func handler(ctx context.Context, levent events.LambdaFunctionURLRequest) (resp
 		return "", fmt.Errorf("failed to load configuration, %w", err)
 	}
 	repo := filepath.Join(env.DstRepo, filepath.Base(data.Body.Repository))
+	tagMutability := types.ImageTagMutabilityMutable
+	if env.ImmutableTags {
+		tagMutability = types.ImageTagMutabilityImmutable
+	}
 	if _, err := ecr.New(ecr.Options{
 		Region:      env.Region,
 		Credentials: cfg.Credentials,
 	}).CreateRepository(ctx, &ecr.CreateRepositoryInput{
-		RepositoryName: &repo,
+		RepositoryName:     &repo,
+		ImageTagMutability: tagMutability,
 	}); err != nil {
 		var rae *types.RepositoryAlreadyExistsException
 		if errors.As(err, &rae) {
@@ -123,12 +129,19 @@ func handler(ctx context.Context, levent events.LambdaFunctionURLRequest) (resp
 	// Sync src:tag to dst:tag.
 	src := "cgr.dev/" + data.Body.Repository + ":" + data.Body.Tag
 	dst := filepath.Join(env.FullDstRepo, filepath.Base(data.Body.Repository)) + ":" + data.Body.Tag
+	kc := authn.NewMultiKeychain(
+		amazonKeychain,
+		cgKeychain{env.Issuer, env.Region, env.Identity},
+	)
+	if env.ImmutableTags {
+		dig, err := crane.Digest(src, crane.WithAuthFromKeychain(kc))
+		if err != nil {
+			return "", fmt.Errorf("getting digest for %s: %w", src, err)
+		}
+		dst += "-" + strings.TrimPrefix(dig, "sha256:")[:6]
+	}
 	log.Printf("Copying %s to %s...", src, dst)
-	if err := crane.Copy(src, dst,
-		crane.WithAuthFromKeychain(authn.NewMultiKeychain(
-			amazonKeychain,
-			cgKeychain{env.Issuer, env.Region, env.Identity},
-		))); err != nil {
+	if err := crane.Copy(src, dst, crane.WithAuthFromKeychain(kc)); err != nil {
 		return "", fmt.Errorf("copying image: %w", err)
 	}
 	log.Printf("Copied %s to %s", src, dst)

image-copy-ecr/iac/lambda.tf

@@ -65,7 +65,7 @@ resource "aws_ecr_repository_policy" "policy" {
 
 resource "aws_ecr_repository" "repo" {
   name                 = var.dst_repo
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = var.immutable_tags ? "IMMUTABLE" : "MUTABLE"
 
   image_scanning_configuration {
     scan_on_push = false
@@ -108,12 +108,13 @@ resource "aws_lambda_function" "lambda" {
 
   environment {
     variables = {
-      GROUP         = var.group
-      IDENTITY      = chainguard_identity.aws.id
-      ISSUER_URL    = "https://issuer.enforce.dev"
-      DST_REPO      = var.dst_repo
-      FULL_DST_REPO = aws_ecr_repository.repo.repository_url
-      REGION        = data.aws_region.current.name
+      GROUP          = var.group
+      IDENTITY       = chainguard_identity.aws.id
+      ISSUER_URL     = "https://issuer.enforce.dev"
+      DST_REPO       = var.dst_repo
+      FULL_DST_REPO  = aws_ecr_repository.repo.repository_url
+      REGION         = data.aws_region.current.name
+      IMMUTABLE_TAGS = var.immutable_tags
     }
   }
 }

image-copy-ecr/iac/variables.tf

@@ -7,3 +7,9 @@ variable "dst_repo" {
   type        = string
   description = "The destination repo where images should be copied to."
 }
+
+variable "immutable_tags" {
+  type        = bool
+  description = "Whether to enable immutable tags."
+  default     = false
+}