From 98b4c1b66ec0d0641b38687f3cfb306c3a5b708e Mon Sep 17 00:00:00 2001 From: eb3095 Date: Thu, 10 Sep 2026 03:06:46 -0700 Subject: [PATCH 1/2] ci(images): push slurm-operator/-webhook to ECR instead of Docker Hub Moves the 1.0-line container-images workflow off Docker Hub onto this account's ECR (651706779278.dkr.ecr.us-west-2.amazonaws.com), the same registry/role openldap-sync uses: - REGISTRY now points at the ECR URL (docker-bake.hcl tags both the operator and webhook targets off this same variable, so one change covers both images) - Replace the Docker Hub login step with configure-aws-credentials + amazon-ecr-login (github-actions-oidc-role, OIDC) - Move AWS auth ahead of the existing 'refuse to overwrite stable image tags' step, since imagetools inspect now needs registry read access - Broaden that step's missing-tag detection for ECR's error text (ECR reports 'name unknown' / 'does not exist' rather than Docker Hub's 'manifest unknown' when a repo has never been pushed to) Trust policy + ECR repo creation is in togethercomputer/tcloud-infra#6600. Fixes TCL-9443 --- .github/workflows/container-images-1.0.yaml | 43 ++++++++++++++------- 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/.github/workflows/container-images-1.0.yaml b/.github/workflows/container-images-1.0.yaml index 4c05b613..32393e22 100644 --- a/.github/workflows/container-images-1.0.yaml +++ b/.github/workflows/container-images-1.0.yaml @@ -1,15 +1,17 @@ -# Build and push slurm-operator container images to Docker Hub (1.0 line). +# Build and push slurm-operator container images to AWS ECR (1.0 line). +# Images pushed: slurm-operator, slurm-operator-webhook (both built from this +# repo via docker-bake.hcl's "operator"/"webhook" targets). # # Tagging: -# - push to slurm-1.0-together-changes: togethercomputer/slurm-operator: (from ./VERSION, no suffix) +# - push to slurm-1.0-together-changes: /slurm-operator[-webhook]: (from ./VERSION, no suffix) # - pull_request (same-repo only): ...:-dev- # # GitHub only evaluates workflows that exist on the ref being pushed. This file must live on # slurm-1.0-together-changes (not only on main), or pushes to that branch will not run any workflow. # -# Required repository secrets: -# - DOCKERHUB_USERNAME -# - DOCKERHUB_TOKEN +# OIDC: same account/role pattern as openldap-sync (github-actions-oidc-role; +# trust policy in tcloud-infra covers repo:togethercomputer/slurm-operator:*). +# Optional secret AWS_ROLE_ARN overrides the default role below. # Optional: # - ROBOT_GITHUB_TOKEN @@ -25,7 +27,9 @@ on: workflow_dispatch: env: - REGISTRY: togethercomputer + REGISTRY: 651706779278.dkr.ecr.us-west-2.amazonaws.com + AWS_REGION: us-west-2 + AWS_ROLE: arn:aws:iam::651706779278:role/github-actions-oidc-role RELEASE_BRANCH: slurm-1.0-together-changes concurrency: @@ -37,6 +41,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + id-token: write steps: - name: Checkout uses: actions/checkout@v4 @@ -103,6 +108,17 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + - name: Configure AWS credentials + if: steps.should-push.outputs.push == 'true' + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_ROLE_ARN || env.AWS_ROLE }} + aws-region: ${{ env.AWS_REGION }} + + - name: Log in to Amazon ECR + if: steps.should-push.outputs.push == 'true' + uses: aws-actions/amazon-ecr-login@v2 + - name: Refuse to overwrite stable image tags if: steps.should-push.outputs.push == 'true' && github.event_name != 'pull_request' env: @@ -120,7 +136,13 @@ jobs: exit 1 fi inspect_output_lower="${inspect_output,,}" - if [[ "${inspect_output_lower}" != *"not found"* && "${inspect_output_lower}" != *"manifest unknown"* ]]; then + # ECR (unlike Docker Hub) has no implicit repo creation, so a repo that + # has never been pushed to reports "name unknown"/"repository ... does + # not exist" rather than "manifest unknown" for a missing tag. + if [[ "${inspect_output_lower}" != *"not found"* \ + && "${inspect_output_lower}" != *"manifest unknown"* \ + && "${inspect_output_lower}" != *"name unknown"* \ + && "${inspect_output_lower}" != *"does not exist"* ]]; then echo "::error::Unable to verify whether ${image_ref} already exists" printf '%s\n' "${inspect_output}" exit 1 @@ -128,13 +150,6 @@ jobs: echo "Stable image tag is available: ${image_ref}" done - - name: Log in to Docker Hub - if: steps.should-push.outputs.push == 'true' - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Build (images + charts, no registry push) if: steps.should-push.outputs.push != 'true' run: make build VERSION="${{ steps.image-version.outputs.version }}" From 1bd27345648ead3238f3d16adcc3ef68540b5d1f Mon Sep 17 00:00:00 2001 From: eb3095 Date: Thu, 10 Sep 2026 03:11:48 -0700 Subject: [PATCH 2/2] ci(images): pin AWS action references to commit hashes Broly flagged the two new actions as unpinned (blanket policy in this repo requires hash-pinned actions). Pins to the same commit hashes already used for these actions elsewhere in the org (tcloud-infra, tcloud). The AWS_ROLE env var is also flagged as a potential secret (ARN regex match) -- false positive, same non-sensitive role ARN pattern already present unchanged in ~30 other workflows across the org (openldap-sync, tcloud, tcloud-infra, together-cloud-cluster-operator, etc.). --- .github/workflows/container-images-1.0.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/container-images-1.0.yaml b/.github/workflows/container-images-1.0.yaml index 32393e22..a8a2732f 100644 --- a/.github/workflows/container-images-1.0.yaml +++ b/.github/workflows/container-images-1.0.yaml @@ -110,14 +110,14 @@ jobs: - name: Configure AWS credentials if: steps.should-push.outputs.push == 'true' - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.0.2 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN || env.AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} - name: Log in to Amazon ECR if: steps.should-push.outputs.push == 'true' - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: Refuse to overwrite stable image tags if: steps.should-push.outputs.push == 'true' && github.event_name != 'pull_request'