registry-identities: support additional ECR account IDs

.github/workflows/bake.yml

@@ -892,6 +892,8 @@ jobs:
         name: Login to Amazon ECR
         if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
         with:
           registry-auth: |
             - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}
@@ -1144,6 +1146,8 @@ jobs:
         name: Login to Amazon ECR
         if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
         with:
           registry-auth: |
             - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}

.github/workflows/build.yml

@@ -792,6 +792,8 @@ jobs:
         name: Login to Amazon ECR
         if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
         with:
           registry-auth: |
             - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}
@@ -1040,6 +1042,8 @@ jobs:
         name: Login to Amazon ECR
         if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
         with:
           registry-auth: |
             - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}

.github/workflows/setup-registry-identities.yml

@@ -25,6 +25,9 @@ on:
       aws-ecr-region:
         description: "AWS region to use for ECR authentication"
         value: ${{ jobs.setup-registry-identities.outputs.aws-ecr-region }}
+      aws-ecr-account-ids:
+        description: "Additional AWS account IDs to authenticate against"
+        value: ${{ jobs.setup-registry-identities.outputs.aws-ecr-account-ids }}
       gcp-wif-enabled:
         description: "Whether a GCP Workload Identity Federation registry identity was configured"
         value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-enabled }}
@@ -74,6 +77,7 @@ jobs:
       aws-ecr-registry: ${{ steps.validate.outputs.aws-ecr-registry }}
       aws-ecr-role-to-assume: ${{ steps.validate.outputs.aws-ecr-role-to-assume }}
       aws-ecr-region: ${{ steps.validate.outputs.aws-ecr-region }}
+      aws-ecr-account-ids: ${{ steps.validate.outputs.aws-ecr-account-ids }}
       gcp-wif-enabled: ${{ steps.validate.outputs.gcp-wif-enabled }}
       gcp-wif-registry: ${{ steps.validate.outputs.gcp-wif-registry }}
       gcp-wif-workload-identity-provider: ${{ steps.validate.outputs.gcp-wif-workload-identity-provider }}
@@ -136,6 +140,7 @@ jobs:
               core.setOutput('aws-ecr-registry', '');
               core.setOutput('aws-ecr-role-to-assume', '');
               core.setOutput('aws-ecr-region', '');
+              core.setOutput('aws-ecr-account-ids', '');
               core.setOutput('gcp-wif-enabled', 'false');
               core.setOutput('gcp-wif-registry', '');
               core.setOutput('gcp-wif-workload-identity-provider', '');
@@ -179,6 +184,7 @@ jobs:
               core.setOutput('aws-ecr-registry', awsEcr?.registry || '');
               core.setOutput('aws-ecr-role-to-assume', awsEcr?.roleToAssume || '');
               core.setOutput('aws-ecr-region', awsEcr?.region || '');
+              core.setOutput('aws-ecr-account-ids', awsEcr?.accountIDs || '');
               core.setOutput('gcp-wif-enabled', gcpWif ? 'true' : 'false');
               core.setOutput('gcp-wif-registry', gcpWif?.registry || '');
               core.setOutput('gcp-wif-workload-identity-provider', gcpWif?.workloadIdentityProvider || '');

.github/workflows/verify.yml

@@ -127,6 +127,8 @@ jobs:
         name: Login to Amazon ECR
         if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
         with:
           registry-auth: |
             - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}

README.md

@@ -514,6 +514,7 @@ jobs:
           registry: 123456789100.dkr.ecr.us-east-1.amazonaws.com
           role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
           region: us-east-1
+          account_ids: 123456789101,123456789102
 ```
 
 | Name             | Type   | Required | Description                                                                                                                     |
@@ -522,11 +523,17 @@ jobs:
 | `registry`       | String | Yes      | Registry server passed to `docker/login-action`, such as `public.ecr.aws` for public ECR or a private ECR host for private ECR. |
 | `role-to-assume` | String | Yes      | IAM role ARN assumed through GitHub OIDC.                                                                                       |
 | `region`         | String | Yes      | AWS region passed to `aws-actions/configure-aws-credentials` when assuming the role. Use `us-east-1` for ECR Public.            |
+| `account_ids`    | String | No       | Comma-separated additional private ECR account IDs to log in to with the assumed role.                                          |
 
 The `registry` value is required for AWS ECR. Use the registry server that
 `docker/login-action` should log in to, such as `public.ecr.aws` for public ECR
 or `123456789100.dkr.ecr.us-east-1.amazonaws.com` for private ECR.
 
+The account ID in the private ECR registry is always included. Set `account_ids`
+to log in to additional accounts in the same region. The assumed role must have
+permission to retrieve authorization tokens for those accounts. This setting
+does not apply to ECR Public.
+
 #### Google Artifact Registry
 
 Google Artifact Registry authentication is configured with `type: gcp-wif`.