fix: 5588 containers missing tag fix #557

Wi11Shell · 2025-01-20T11:11:14Z

Description

fixing failed CD workflow

Related issue: https://dvsa.atlassian.net/browse/VOL-5950

Before submitting (or marking as "ready for review")

Does the pull request title follow the conventional commit specification?
Have you performed a self-review of the code
Have you have added tests that prove the fix or feature is effective and working
Did you make sure to update any documentation relating to this change?

github-actions · 2025-01-20T11:12:24Z

Terraform plan for account: `nonprod`

Commit: 7e8bb2a

Plan summary

4 to add, 1 to change, 0 to destroy

🆕 Creates

module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["search"].aws_ecr_repository.this[0]
module.account.module.ecr["search"].aws_ecr_repository_policy.this[0]

🔄 Updates

module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be updated in-place
  ~ resource "aws_ecr_repository" "this" {
        id                   = "vol-app/liquibase"
      ~ image_tag_mutability = "IMMUTABLE" -> "MUTABLE"
        name                 = "vol-app/liquibase"
        tags                 = {}
        # (4 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

  # module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "IMMUTABLE"
      + name                 = "vol-app/search"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::054614622558:role/vol-app-github-actions-role",
                              + "arn:aws:iam::054614622558:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::054614622558:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

Plan: 4 to add, 1 to change, 0 to destroy.

github-actions · 2025-01-20T11:12:32Z

Terraform plan for account: `prod`

Commit: 7e8bb2a

Plan summary

8 to add, 0 to change, 0 to destroy

🆕 Creates

module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0]
module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["search"].aws_ecr_repository.this[0]
module.account.module.ecr["search"].aws_ecr_repository_policy.this[0]

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

  # module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "MUTABLE"
      + name                 = "vol-app/liquibase"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-role",
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::146997448015:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

  # module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

  # module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "IMMUTABLE"
      + name                 = "vol-app/search"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-role",
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::146997448015:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

Plan: 8 to add, 0 to change, 0 to destroy.

Wi11Shell requested a review from a team as a code owner January 20, 2025 11:11

Wi11Shell added 13 commits January 20, 2025 11:13

fix: added service identifiers

479654d

fix: updated pipelines

604f45b

fix: update search tag var

4204fcb

fix: add continue on error to docker security

8d1bf83

fix: linting

a3f34d9

fix: move continue on error

e639dce

fix: allow security-docker to fail

28c60b2

fix: only run app for app changes

1d367a3

fix: removed docker-files from app conditional

b9298cc

fix: add null to app conditional

de6947d

fix: download artefact conditional

2a5e7c6

fix: if not search

0b91396

fix: add missing search image tags

92d8bd8

Wi11Shell force-pushed the 5588-containers-search branch from 7e8bb2a to 92d8bd8 Compare January 20, 2025 11:13

fibble approved these changes Jan 20, 2025

View reviewed changes

barkerl approved these changes Jan 20, 2025

View reviewed changes

barkerl merged commit 08e8d0b into main Jan 20, 2025
17 of 19 checks passed

barkerl deleted the 5588-containers-search branch January 20, 2025 11:24

github-actions bot mentioned this pull request Jan 20, 2025

chore(main): release 5.14.0 #550

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: 5588 containers missing tag fix #557

fix: 5588 containers missing tag fix #557

Wi11Shell commented Jan 20, 2025

github-actions bot commented Jan 20, 2025

github-actions bot commented Jan 20, 2025

fix: 5588 containers missing tag fix #557

fix: 5588 containers missing tag fix #557

Conversation

Wi11Shell commented Jan 20, 2025

Description

Before submitting (or marking as "ready for review")

github-actions bot commented Jan 20, 2025

Terraform plan for account: nonprod

Plan summary

github-actions bot commented Jan 20, 2025

Terraform plan for account: prod

Plan summary

Terraform plan for account: `nonprod`

Terraform plan for account: `prod`