Repository navigation
fix(image): skip the ECR lookup when a run only builds - #9
Merged
Merged
Conversation
A run that only builds, such as a pull request without the label push-image, does not log in to AWS. The ECR lookup still ran, so on a runner without its own AWS credentials it failed the job with NoCredentials. Such a run now skips the lookup and always builds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
image.ymllooked up the commit tag in ECR on every run, but it logs in to AWS only when it pushes. A run that only builds, such as a pull request without the labelpush-image, had no AWS credentials there. On a runner without its own AWS credentials (the GitHub-hosted runners of public repos such as tiros and parsec), the lookup failed the job withNoCredentials.The lookup now runs only when the job pushes. A run that only builds always builds, which is what it is for: to check that the image builds.
How I checked it
NoCredentials: Unable to locate credentials.just ci(actionlint) passes.Deploy
Nothing. Callers use
@main, so the fix reaches them at merge. Onprobelab-ci, a build-only pull request whose tag is already in ECR now builds instead of skipping the build.