main.yml

name: Main

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}

      - name: Build container image
        uses: kciter/aws-ecr-action@v4
        with:
          account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          region: ${{ env.AWS_REGION }}
          tags: latest,${{ env.GITHUB_EVENT_REF_SLUG }},${{ env.GITHUB_SHA_SHORT }},${{ env.GITHUB_SHA }}
          repo: ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG}}
          create_repo: true
          # FIXME: This is a workaround to deal with how the action works and so we can
          # continue to use the aws-actions/configure-aws-credentials
          access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
          secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          set_repo_policy: true
          repo_policy_file: .github/workflows/ecr-policy.json