From 3d56b802a45d1aaba89e5ca0c8299ae1aed41241 Mon Sep 17 00:00:00 2001 From: scottlee01818 Date: Thu, 23 Jul 2026 11:40:06 +0000 Subject: [PATCH 1/5] feat: add push to shared registry This adds steps to push to the shared registry in the WanAware shared GCP project. We must first run the logic to push to the shared registry so that steps following the build/push steps use the original authentication mechanism. All steps to push to the shared registry are allowed to fail so that existing workflows are not impacted by this new change. --- .github/workflows/deployment.yaml | 48 +++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml index 623e75c..3d2fb95 100644 --- a/.github/workflows/deployment.yaml +++ b/.github/workflows/deployment.yaml @@ -123,20 +123,29 @@ jobs: - name: Checkout code uses: actions/checkout@v3 - - name: Authenticate with GCP + # --- GCR push to shared account --- + + # NOTE: we push to the shared account first so that steps following + # this build/push (e.g. GKE deploy) use the normal gcloud credentials. + # all steps related to the shared account are allowed to fail so + # that existing workflows are not impacted. + - name: Authenticate with GCP Shared Account uses: google-github-actions/auth@v2 + continue-on-error: true with: - workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} - service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} + workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED }} + service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_SHARED }} - - name: Set up gcloud + - name: Set up gcloud for GCP Shared Account uses: google-github-actions/setup-gcloud@v2 + continue-on-error: true with: - project_id: ${{ secrets.GCP_PROJECT }} + project_id: ${{ secrets.GCP_PROJECT_SHARED }} - - name: Configure Docker to use the gcloud command-line tool as a credential helper + - name: Configure Docker to use the gcloud command-line tool as a credential helper for GCP Shared Registry + continue-on-error: true if: ${{ inputs.deploy_type != 'release-only' }} - run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY }} + run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY_SHARED }} # The env-file artifact (repo .env + GitHub secrets appended by the caller's # prepare-env job) is no longer baked into the image. It is downloaded to a @@ -161,7 +170,9 @@ jobs: file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }} push: false load: true - tags: ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest + tags: | + ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest + ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest build-args: | GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} @@ -176,6 +187,27 @@ jobs: severity: 'CRITICAL,HIGH' exit-code: '1' + - name: Push Docker image to GCP Shared Account + continue-on-error: true + if: ${{ inputs.deploy_type != 'release-only' }} + run: docker push ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest + + # --- GCR push to standard account --- + - name: Authenticate with GCP + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} + + - name: Set up gcloud + uses: google-github-actions/setup-gcloud@v2 + with: + project_id: ${{ secrets.GCP_PROJECT }} + + - name: Configure Docker to use the gcloud command-line tool as a credential helper + if: ${{ inputs.deploy_type != 'release-only' }} + run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY }} + - name: Push Docker image if: ${{ inputs.deploy_type != 'release-only' }} run: docker push ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest From eeea5a38eea59ad87e7d1e256a4c0e57c38a4653 Mon Sep 17 00:00:00 2001 From: scottlee01818 Date: Fri, 24 Jul 2026 10:01:29 +0000 Subject: [PATCH 2/5] refactor: add duplicate docker build step This was added to ensure that we continue on error if something goes wrong with the shared image build (e.g. missing env var settings) as we do not want to affect the current workflow. --- .github/workflows/deployment.yaml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml index 3d2fb95..25ce577 100644 --- a/.github/workflows/deployment.yaml +++ b/.github/workflows/deployment.yaml @@ -170,12 +170,27 @@ jobs: file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }} push: false load: true - tags: | - ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest - ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest + tags: ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest build-args: | GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} + # we use a separete step here for the shared account instead of line separated tags to ensure + # that we still continue on error if this step fails. + - name: Build Docker image for GCP Shared Account + if: ${{ inputs.deploy_type != 'release-only' }} + continue-on-error: true + id: build + uses: docker/build-push-action@v4 + with: + context: ${{ inputs.docker_context }} + file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }} + push: false + load: true + tags: ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest + build-args: | + GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} + + # only a single scan is required since both images are identical with different tags - name: Run Trivy vulnerability scanner on image if: ${{ inputs.deploy_type != 'release-only' }} uses: aquasecurity/trivy-action@0.35.0 From 010a3594b2bf5b65f6567eac140dc6f4c6d923a1 Mon Sep 17 00:00:00 2001 From: scottlee01818 Date: Fri, 24 Jul 2026 10:24:36 +0000 Subject: [PATCH 3/5] fix: correct missing secret definitions and dupe step id Signed-off-by: scottlee01818 --- .github/workflows/deployment.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml index 25ce577..066616c 100644 --- a/.github/workflows/deployment.yaml +++ b/.github/workflows/deployment.yaml @@ -97,6 +97,18 @@ on: BUCKET_NAME: required: false + # secrets for shared image push + GCP_SERVICE_ACCOUNT_SHARED: + required: true + description: 'GCP service account email to impersonate via WIF (e.g. tf-deploy@my-project.iam.gserviceaccount.com).' + GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED: + required: true + description: 'Full WIF provider resource name (e.g. projects/123/locations/global/workloadIdentityPools/github-actions-pool/providers/github-provider).' + GCP_PROJECT_SHARED: + required: false + GCP_REGISTRY_SHARED: + required: false + jobs: deploy: name: Build, Publish, and Deploy @@ -179,7 +191,7 @@ jobs: - name: Build Docker image for GCP Shared Account if: ${{ inputs.deploy_type != 'release-only' }} continue-on-error: true - id: build + id: build-shared uses: docker/build-push-action@v4 with: context: ${{ inputs.docker_context }} From 81eebe8f0d10adda44f87c30aa428ef1838279dd Mon Sep 17 00:00:00 2001 From: scottlee01818 Date: Fri, 24 Jul 2026 05:29:08 -0500 Subject: [PATCH 4/5] refactor: use simple docker tag instead of full rebuild Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- .github/workflows/deployment.yaml | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml index 066616c..1638ccf 100644 --- a/.github/workflows/deployment.yaml +++ b/.github/workflows/deployment.yaml @@ -186,21 +186,17 @@ jobs: build-args: | GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} - # we use a separete step here for the shared account instead of line separated tags to ensure - # that we still continue on error if this step fails. - - name: Build Docker image for GCP Shared Account + # Retag the already-built standard image for the shared registry. + # A separate step (rather than an additional tag in the build step) keeps + # continue-on-error scoped to this step alone. + - name: Tag Docker image for GCP Shared Account if: ${{ inputs.deploy_type != 'release-only' }} continue-on-error: true - id: build-shared - uses: docker/build-push-action@v4 - with: - context: ${{ inputs.docker_context }} - file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }} - push: false - load: true - tags: ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest - build-args: | - GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} + id: tag_shared + run: | + docker tag \ + ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest \ + ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest # only a single scan is required since both images are identical with different tags - name: Run Trivy vulnerability scanner on image From e758601bd9e207c018cbc2381a8ecfb95fa615c3 Mon Sep 17 00:00:00 2001 From: scottlee01818 Date: Fri, 24 Jul 2026 10:30:15 +0000 Subject: [PATCH 5/5] fix: change shared registry values to optional Signed-off-by: scottlee01818 --- .github/workflows/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml index 1638ccf..049612d 100644 --- a/.github/workflows/deployment.yaml +++ b/.github/workflows/deployment.yaml @@ -99,10 +99,10 @@ on: # secrets for shared image push GCP_SERVICE_ACCOUNT_SHARED: - required: true + required: false description: 'GCP service account email to impersonate via WIF (e.g. tf-deploy@my-project.iam.gserviceaccount.com).' GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED: - required: true + required: false description: 'Full WIF provider resource name (e.g. projects/123/locations/global/workloadIdentityPools/github-actions-pool/providers/github-provider).' GCP_PROJECT_SHARED: required: false