add configure-aws-credentials for helm deployment

milaboratory · Sep 6, 2023 · 4dff783 · 4dff783
1 parent 759c6d7
commit 4dff783
Showing 1 changed file with 25 additions and 11 deletions.
diff --git a/.github/workflows/docker-ecr.yaml b/.github/workflows/docker-ecr.yaml
@@ -379,14 +379,14 @@ jobs:
       matrix: ${{ fromJSON(needs.setup-matrix.outputs.matrix-build) }}
     runs-on: ${{ matrix.agent }}
     steps:
-      - id: context
-        uses: milaboratory/github-ci/actions/context@v4
-
       - uses: milaboratory/github-ci/actions/env@v4
         with:
           inputs: ${{ inputs.env }}
           secrets: ${{ secrets.env }}
 
+      - id: context
+        uses: milaboratory/github-ci/actions/context@v4
+
       - uses: actions/checkout@v3
         with:
           submodules: ${{ inputs.checkout-submodules }}
@@ -418,9 +418,11 @@ jobs:
       - id: login-ecr
         if: github.event_name != 'pull_request'
         uses: aws-actions/amazon-ecr-login@v1
+        with:
+          mask-password: 'true'
 
       - id: transform-version
-        uses: milaboratory/github-ci/actions/shell@v4
+        uses: milaboratory/github-ci/actions/shell@v4-beta
         env:
           CURRENT_VERSION: ${{ steps.context.outputs.current-version }}
           REGISTRY: ${{ steps.login-ecr.outputs.registry }}
@@ -530,21 +532,23 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - id: context
-        uses: milaboratory/github-ci/actions/context@v4
-
       - uses: milaboratory/github-ci/actions/env@v4
         with:
           inputs: ${{ inputs.env }}
           secrets: ${{ secrets.env }}
 
+      - id: context
+        uses: milaboratory/github-ci/actions/context@v4
+
       - uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: ${{ inputs.aws-iam-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
       - id: login-ecr
         uses: aws-actions/amazon-ecr-login@v1
+        with:
+          mask-password: 'true'
 
       - uses: milaboratory/github-ci/actions/setup-regctl@v4
         with:
@@ -657,15 +661,18 @@ jobs:
     needs:
       - release
       - setup-matrix
+    permissions:
+      id-token: write
+      contents: read
     steps:
-      - id: context
-        uses: milaboratory/github-ci/actions/context@v4
-
       - uses: milaboratory/github-ci/actions/env@v4
         with:
           inputs: ${{ inputs.env }}
           secrets: ${{ secrets.env }}
 
+      - id: context
+        uses: milaboratory/github-ci/actions/context@v4
+
       - uses: actions/checkout@v3
 
       - uses: milaboratory/github-ci/actions/git/crypt@v4
@@ -674,8 +681,15 @@ jobs:
           gpg-key: ${{ secrets.GIT_CRYPT_GPG_KEY }}
           gpg-key-password: ${{ secrets.GIT_CRYPT_KEY_PASSWORD }}
 
+      - uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ inputs.aws-iam-role-to-assume }}
+          aws-region: ${{ inputs.aws-region }}
+
       - id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v1.6.0
+        uses: aws-actions/amazon-ecr-login@v1
+        with:
+          mask-password: 'true'
 
       - uses: milaboratory/github-ci/actions/shell@v4
         env: