Skip to content

feat: add shared registry push #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
scottlee01818 wants to merge 5 commits into from
Closed

feat: add shared registry push #43

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3d56b80
feat: add push to shared registry
scottlee01818 Jul 23, 2026
eeea5a3
refactor: add duplicate docker build step
scottlee01818 Jul 24, 2026
010a359
fix: correct missing secret definitions and dupe step id
scottlee01818 Jul 24, 2026
81eebe8
refactor: use simple docker tag instead of full rebuild
scottlee01818 Jul 24, 2026
e758601
fix: change shared registry values to optional
scottlee01818 Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 62 additions & 7 deletions .github/workflows/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,18 @@ on:
BUCKET_NAME:
required: false

# secrets for shared image push
GCP_SERVICE_ACCOUNT_SHARED:
required: false
description: 'GCP service account email to impersonate via WIF (e.g. tf-deploy@my-project.iam.gserviceaccount.com).'
GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED:
required: false
description: 'Full WIF provider resource name (e.g. projects/123/locations/global/workloadIdentityPools/github-actions-pool/providers/github-provider).'
Comment thread
greptile-apps[bot] marked this conversation as resolved.
GCP_PROJECT_SHARED:
required: false
GCP_REGISTRY_SHARED:
required: false

jobs:
deploy:
name: Build, Publish, and Deploy
Expand All @@ -123,20 +135,29 @@ jobs:
- name: Checkout code
uses: actions/checkout@v3

- name: Authenticate with GCP
# --- GCR push to shared account ---

# NOTE: we push to the shared account first so that steps following
# this build/push (e.g. GKE deploy) use the normal gcloud credentials.
# all steps related to the shared account are allowed to fail so
# that existing workflows are not impacted.
- name: Authenticate with GCP Shared Account

@muhammad-tahir-nawaz muhammad-tahir-nawaz Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't additive - the standard Authenticate with GCP / Set up gcloud / configure-docker block has been moved from before the build to after Trivy. Since the shared auth that now precedes the build is continue-on-error: true, any repo that hasn't set the four _SHARED secrets will reach Build Docker image with no gcloud credentials and no docker credential helper configured at all. Any Dockerfile with a FROM ${GCP_REGISTRY}/... base image, or any build pulling from GAR, will break where it works today.

Can we keep the original standard-auth block in its original position (before the build) and add the shared auth block as new steps after the build, right before the shared tag/push, then re-auth to standard before Push Docker image? That keeps the change genuinely additive for every existing caller.

@muhammad-tahir-nawaz muhammad-tahir-nawaz Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Related to the above: google-github-actions/auth writes GOOGLE_APPLICATION_CREDENTIALS into the workspace and gcloud auth configure-docker writes ~/.docker/config.json. On ephemeral ARC pods that's re-created per run so re-authenticating is clean, but on a non-ephemeral self-hosted runner the shared credentials could linger between runs and leak into an unrelated job. Can you confirm every consumer of this reusable workflow is on ephemeral runners?

uses: google-github-actions/auth@v2
continue-on-error: true
with:
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_SHARED }}

- name: Set up gcloud
- name: Set up gcloud for GCP Shared Account
uses: google-github-actions/setup-gcloud@v2
continue-on-error: true
with:
project_id: ${{ secrets.GCP_PROJECT }}
project_id: ${{ secrets.GCP_PROJECT_SHARED }}

- name: Configure Docker to use the gcloud command-line tool as a credential helper
- name: Configure Docker to use the gcloud command-line tool as a credential helper for GCP Shared Registry
continue-on-error: true
if: ${{ inputs.deploy_type != 'release-only' }}
run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY }}
run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY_SHARED }}

# The env-file artifact (repo .env + GitHub secrets appended by the caller's
# prepare-env job) is no longer baked into the image. It is downloaded to a
Expand Down Expand Up @@ -165,6 +186,19 @@ jobs:
build-args: |
GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }}

# Retag the already-built standard image for the shared registry.
# A separate step (rather than an additional tag in the build step) keeps
# continue-on-error scoped to this step alone.
- name: Tag Docker image for GCP Shared Account
if: ${{ inputs.deploy_type != 'release-only' }}
continue-on-error: true
id: tag_shared
run: |
docker tag \
${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest \
${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest

# only a single scan is required since both images are identical with different tags

@muhammad-tahir-nawaz muhammad-tahir-nawaz Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small clarity point - this comment sits above Trivy but the retag happens before it and the shared push after it. Worth rewording to say the scan gates both pushes, so it's clear the shared image is covered by the same gate rather than being scanned separately.

- name: Run Trivy vulnerability scanner on image
if: ${{ inputs.deploy_type != 'release-only' }}
uses: aquasecurity/trivy-action@0.35.0
Expand All @@ -176,6 +210,27 @@ jobs:
severity: 'CRITICAL,HIGH'
exit-code: '1'

- name: Push Docker image to GCP Shared Account
continue-on-error: true
if: ${{ inputs.deploy_type != 'release-only' }}
run: docker push ${{ secrets.GCP_REGISTRY_SHARED }}/${{ secrets.GCP_PROJECT_SHARED }}/${{ inputs.image_path }}:latest

# --- GCR push to standard account ---
- name: Authenticate with GCP
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

- name: Set up gcloud
uses: google-github-actions/setup-gcloud@v2
with:
project_id: ${{ secrets.GCP_PROJECT }}

- name: Configure Docker to use the gcloud command-line tool as a credential helper
if: ${{ inputs.deploy_type != 'release-only' }}
run: gcloud auth configure-docker ${{ secrets.GCP_REGISTRY }}

- name: Push Docker image
if: ${{ inputs.deploy_type != 'release-only' }}
run: docker push ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest
Expand Down
Loading