From 5517520d15037ff029eca316e506b1cb5439dbdb Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:28:54 +0200 Subject: [PATCH] registry-identities: support additional ECR account IDs Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/bake.yml | 4 ++++ .github/workflows/build.yml | 4 ++++ .github/workflows/setup-registry-identities.yml | 6 ++++++ .github/workflows/verify.yml | 2 ++ README.md | 7 +++++++ 5 files changed, 23 insertions(+) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index ed35cd3c..2f252424 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -892,6 +892,8 @@ jobs: name: Login to Amazon ECR if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }} @@ -1144,6 +1146,8 @@ jobs: name: Login to Amazon ECR if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 03ad3003..2a7d034d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -792,6 +792,8 @@ jobs: name: Login to Amazon ECR if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }} @@ -1040,6 +1042,8 @@ jobs: name: Login to Amazon ECR if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }} diff --git a/.github/workflows/setup-registry-identities.yml b/.github/workflows/setup-registry-identities.yml index 9ed866d3..790c25b2 100644 --- a/.github/workflows/setup-registry-identities.yml +++ b/.github/workflows/setup-registry-identities.yml @@ -25,6 +25,9 @@ on: aws-ecr-region: description: "AWS region to use for ECR authentication" value: ${{ jobs.setup-registry-identities.outputs.aws-ecr-region }} + aws-ecr-account-ids: + description: "Additional AWS account IDs to authenticate against" + value: ${{ jobs.setup-registry-identities.outputs.aws-ecr-account-ids }} gcp-wif-enabled: description: "Whether a GCP Workload Identity Federation registry identity was configured" value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-enabled }} @@ -74,6 +77,7 @@ jobs: aws-ecr-registry: ${{ steps.validate.outputs.aws-ecr-registry }} aws-ecr-role-to-assume: ${{ steps.validate.outputs.aws-ecr-role-to-assume }} aws-ecr-region: ${{ steps.validate.outputs.aws-ecr-region }} + aws-ecr-account-ids: ${{ steps.validate.outputs.aws-ecr-account-ids }} gcp-wif-enabled: ${{ steps.validate.outputs.gcp-wif-enabled }} gcp-wif-registry: ${{ steps.validate.outputs.gcp-wif-registry }} gcp-wif-workload-identity-provider: ${{ steps.validate.outputs.gcp-wif-workload-identity-provider }} @@ -136,6 +140,7 @@ jobs: core.setOutput('aws-ecr-registry', ''); core.setOutput('aws-ecr-role-to-assume', ''); core.setOutput('aws-ecr-region', ''); + core.setOutput('aws-ecr-account-ids', ''); core.setOutput('gcp-wif-enabled', 'false'); core.setOutput('gcp-wif-registry', ''); core.setOutput('gcp-wif-workload-identity-provider', ''); @@ -179,6 +184,7 @@ jobs: core.setOutput('aws-ecr-registry', awsEcr?.registry || ''); core.setOutput('aws-ecr-role-to-assume', awsEcr?.roleToAssume || ''); core.setOutput('aws-ecr-region', awsEcr?.region || ''); + core.setOutput('aws-ecr-account-ids', awsEcr?.accountIDs || ''); core.setOutput('gcp-wif-enabled', gcpWif ? 'true' : 'false'); core.setOutput('gcp-wif-registry', gcpWif?.registry || ''); core.setOutput('gcp-wif-workload-identity-provider', gcpWif?.workloadIdentityProvider || ''); diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 8b164719..15ee03f2 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -127,6 +127,8 @@ jobs: name: Login to Amazon ECR if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }} diff --git a/README.md b/README.md index 8ed58594..d1f9f90f 100644 --- a/README.md +++ b/README.md @@ -514,6 +514,7 @@ jobs: registry: 123456789100.dkr.ecr.us-east-1.amazonaws.com role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role region: us-east-1 + account_ids: 123456789101,123456789102 ``` | Name | Type | Required | Description | @@ -522,11 +523,17 @@ jobs: | `registry` | String | Yes | Registry server passed to `docker/login-action`, such as `public.ecr.aws` for public ECR or a private ECR host for private ECR. | | `role-to-assume` | String | Yes | IAM role ARN assumed through GitHub OIDC. | | `region` | String | Yes | AWS region passed to `aws-actions/configure-aws-credentials` when assuming the role. Use `us-east-1` for ECR Public. | +| `account_ids` | String | No | Comma-separated additional private ECR account IDs to log in to with the assumed role. | The `registry` value is required for AWS ECR. Use the registry server that `docker/login-action` should log in to, such as `public.ecr.aws` for public ECR or `123456789100.dkr.ecr.us-east-1.amazonaws.com` for private ECR. +The account ID in the private ECR registry is always included. Set `account_ids` +to log in to additional accounts in the same region. The assumed role must have +permission to retrieve authorization tokens for those accounts. This setting +does not apply to ECR Public. + #### Google Artifact Registry Google Artifact Registry authentication is configured with `type: gcp-wif`.