build-public-image-on-ecr-with-vault.yml

name: Build image

on:
  workflow_call:
    secrets:
      vault_token:
        required: true
    inputs:
      PROJECT_NAME:
        required: true
        type: string
      VAULT_AWS_NAME:
        required: false
        type: string
        default: aws_devops_tools
      BASE_PUBLIC_REGISTRY_PATH:
        required: false
        type: string
        default: public.ecr.aws/u5f6g0h4
      REGISTRY_NAME:
        required: false
        type: string
        default: crispy-bacon-public-ecr
    
jobs:   
  build_docker_image:
    runs-on: ubuntu-latest
    steps:
    - name: Import Secrets
      uses: hashicorp/vault-action@v2.4.2
      with:
        url: https://vault.crispybacon.it
        token: ${{ secrets.vault_token }}
        secrets: |
          ${{ inputs.VAULT_AWS_NAME }}/creds/github-pipeline-access-role access_key | AWS_ACCESS_KEY_ID ;
          ${{ inputs.VAULT_AWS_NAME }}/creds/github-pipeline-access-role secret_key | AWS_SECRET_ACCESS_KEY ;
    - name: Wait for IAM credentials to be ready
      run: sleep 10
    - uses: actions/checkout@v3
    - name: Login ECR registry
      run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${{ inputs.BASE_PUBLIC_REGISTRY_PATH }}
    - name: Build the Docker image
      run: docker build -t ${{ inputs.BASE_PUBLIC_REGISTRY_PATH }}/${{ inputs.REGISTRY_NAME }}:${{ inputs.PROJECT_NAME }}-${{ github.ref_name }} .
    - name: Push docker image
      run: docker push public.ecr.aws/u5f6g0h4/crispy-bacon-public-ecr:${{ inputs.PROJECT_NAME }}-${{ github.ref_name }}