From 004d5b33e5099f5baee4e17c7839353a28454ebf Mon Sep 17 00:00:00 2001 From: Dennis Trautwein Date: Wed, 11 Nov 2026 09:06:37 +0100 Subject: [PATCH] fix(image): skip the ECR lookup when a run only builds A run that only builds, such as a pull request without the label push-image, does not log in to AWS. The ECR lookup still ran, so on a runner without its own AWS credentials it failed the job with NoCredentials. Such a run now skips the lookup and always builds. --- .github/workflows/image.yml | 3 +++ CHANGELOG.md | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml index 5c366ca..227bfec 100644 --- a/.github/workflows/image.yml +++ b/.github/workflows/image.yml @@ -144,8 +144,11 @@ jobs: if: env.PUSH == 'true' uses: aws-actions/amazon-ecr-login@v2 + # Only a run that pushes logs in to AWS, so a run that only builds + # skips the lookup and always builds. - name: Checking if ${{ steps.tags.outputs.tag }} exists id: exists + if: env.PUSH == 'true' env: REPOSITORY: ${{ env.ECR_REPOSITORY }} TAG: ${{ steps.tags.outputs.tag }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 75eba0b..942668f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,15 @@ workflows at `@main`, so a change reaches every caller when it merges. Old callers keep `@v1`. Changes are listed under the date of the merge, in the format of [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## 2026-11-11 + +### Fixed + +- `image.yml`: a run that only builds, such as a pull request without the + label `push-image`, no longer looks up the image in ECR. It has no AWS + login, so on a runner without its own AWS credentials the lookup failed + the job with `NoCredentials`. Such a run now always builds. + ## 2026-11-10 The special cases of single repos move out of the shared workflows, and