mirror-slim-image.yml

name: Mirror Slim Image

# Mirrors slim service images published by supabase/slim-services from ghcr.io/supabase/cli to
# public.ecr.aws/supabase/cli. The sender polls the ECR Public destination and fails its release
# unless it resolves to the exact index digest published, so the copy must be digest-preserving
# via `regctl image copy` (byte-for-byte); do not switch to `docker buildx imagetools create`,
# which can rewrite the index and change its digest.
#
# The payload arrives with whatever authority holds the dispatch token, so it is treated as
# untrusted: names are pattern-checked, source/destination are derived in
# `.github/scripts/mirror-slim-image.ts` rather than trusted from the payload, and the source
# must resolve to the claimed digest before anything is copied.
#
# `upload-natives-s3` copies the same native triplets (fetched from GHCR by digest and
# re-verified) to the public-read S3 bucket in the cli-artifacts-prod account, for sandboxes that
# allow `*.amazonaws.com` but block registry blob CDNs. It runs in parallel with the ECR copy so an
# ECR Public outage or missing permission never holds back the S3 mirror, is best-effort like the
# native ECR copy, and uses the PutObject-only `slim-artifacts-publisher` role
# (infra/cli-artifacts/README.md).
#
# Replay locally: `bun .github/scripts/mirror-slim-image.ts --help`
# Full contract: docs/design/ecr-mirror-dispatch.md in supabase/slim-services.

on:
  repository_dispatch:
    types:
      - mirror-slim-image
  workflow_dispatch:
    inputs:
      service:
        description: "Service name (e.g. postgrest)"
        required: true
        type: string
      version:
        description: "Image tag (e.g. v16.2)"
        required: true
        type: string
      digest:
        description: "Expected index digest (sha256:<64 hex chars>)"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: mirror-slim-image-${{ github.event.client_payload.service || inputs.service }}-${{ github.event.client_payload.version || inputs.version }}
  cancel-in-progress: false

jobs:
  mirror:
    runs-on: ubuntu-latest
    # The sender's poll times out after 15 minutes; native copies run after the
    # image copy and must still finish inside that window.
    timeout-minutes: 13
    permissions:
      contents: read
      packages: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Validate payload
        id: validate
        env:
          EVENT_NAME: ${{ github.event_name }}
          SERVICE: ${{ github.event.client_payload.service || inputs.service }}
          VERSION: ${{ github.event.client_payload.version || inputs.version }}
          DIGEST: ${{ github.event.client_payload.digest || inputs.digest }}
          PAYLOAD_SOURCE: ${{ github.event.client_payload.source }}
          PAYLOAD_DESTINATION: ${{ github.event.client_payload.destination }}
        run: bun .github/scripts/mirror-slim-image.ts validate

      - name: Install regctl
        # $RUNNER_TEMP is always writable by the job user.
        run: |
          set -euo pipefail
          install -d "${RUNNER_TEMP}/regctl-bin"
          curl -fsSLo "${RUNNER_TEMP}/regctl-bin/regctl" \
            https://github.com/regclient/regclient/releases/download/v0.11.5/regctl-linux-amd64
          echo "c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467  ${RUNNER_TEMP}/regctl-bin/regctl" | sha256sum -c -
          chmod +x "${RUNNER_TEMP}/regctl-bin/regctl"
          echo "${RUNNER_TEMP}/regctl-bin" >> "$GITHUB_PATH"
          "${RUNNER_TEMP}/regctl-bin/regctl" version

      - name: Log in to ghcr.io
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify source digest
        env:
          REFERENCE: ${{ steps.validate.outputs.source }}
          DIGEST: ${{ steps.validate.outputs.digest }}
        run: bun .github/scripts/mirror-slim-image.ts verify-digest

      - name: Configure aws credentials
        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
        with:
          role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
          aws-region: us-east-1

      - name: Log in to ECR Public
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: public.ecr.aws

      - name: Ensure ECR Public repository exists
        env:
          SERVICE: ${{ steps.validate.outputs.service }}
        run: bun .github/scripts/mirror-slim-image.ts ensure-repo

      - name: Mirror image
        env:
          SOURCE: ${{ steps.validate.outputs.source }}
          DESTINATION: ${{ steps.validate.outputs.destination }}
          DIGEST: ${{ steps.validate.outputs.digest }}
        # Copies by digest (not tag) so it can't race a tag move on the source, and runs
        # unconditionally with no early exit: regctl's copy is incremental, so re-dispatching
        # after a complete copy is a cheap no-op, and after a partial failure it finishes the
        # copy instead of skipping it.
        run: bun .github/scripts/mirror-slim-image.ts copy-image

      - name: Verify destination digest
        env:
          REFERENCE: ${{ steps.validate.outputs.destination }}
          DIGEST: ${{ steps.validate.outputs.digest }}
          # ECR Public can serve the tag's previous digest (or a 404) for ~30 s after the push;
          # 13 reads 10 s apart allow ~2 min.
          ATTEMPTS: "13"
        run: bun .github/scripts/mirror-slim-image.ts verify-digest

      - name: Mirror native artifacts
        continue-on-error: true
        env:
          SERVICE: ${{ steps.validate.outputs.service }}
          VERSION: ${{ steps.validate.outputs.version }}
          EVENT_NAME: ${{ github.event_name }}
        # Native tags are copied without --referrers. Failure must not fail the
        # image digest the sender polls; daily audit reports native drift.
        run: bun .github/scripts/mirror-slim-image.ts copy-natives

  upload-natives-s3:
    # Natives only ride in repository_dispatch payloads. Nothing reaches the public bucket from a
    # dispatch whose source image digest check fails. The job is skipped until the
    # cli-artifacts-prod account exists and its ID is set as a repository variable.
    if: ${{ github.event_name == 'repository_dispatch' && vars.CLI_ARTIFACTS_AWS_ACCOUNT_ID != '' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    continue-on-error: true
    permissions:
      contents: read
      packages: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Validate payload
        id: validate
        env:
          EVENT_NAME: ${{ github.event_name }}
          SERVICE: ${{ github.event.client_payload.service }}
          VERSION: ${{ github.event.client_payload.version }}
          DIGEST: ${{ github.event.client_payload.digest }}
          PAYLOAD_SOURCE: ${{ github.event.client_payload.source }}
          PAYLOAD_DESTINATION: ${{ github.event.client_payload.destination }}
        run: bun .github/scripts/mirror-slim-image.ts validate

      - name: Install regctl
        run: |
          set -euo pipefail
          install -d "${RUNNER_TEMP}/regctl-bin"
          curl -fsSLo "${RUNNER_TEMP}/regctl-bin/regctl" \
            https://github.com/regclient/regclient/releases/download/v0.11.5/regctl-linux-amd64
          echo "c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467  ${RUNNER_TEMP}/regctl-bin/regctl" | sha256sum -c -
          chmod +x "${RUNNER_TEMP}/regctl-bin/regctl"
          echo "${RUNNER_TEMP}/regctl-bin" >> "$GITHUB_PATH"
          "${RUNNER_TEMP}/regctl-bin/regctl" version

      - name: Log in to ghcr.io
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify source digest
        env:
          REFERENCE: ${{ steps.validate.outputs.source }}
          DIGEST: ${{ steps.validate.outputs.digest }}
        run: bun .github/scripts/mirror-slim-image.ts verify-digest

      - name: Fetch and verify native artifacts
        id: fetch
        env:
          SERVICE: ${{ steps.validate.outputs.service }}
          VERSION: ${{ steps.validate.outputs.version }}
          EVENT_NAME: ${{ github.event_name }}
          OUTPUT_DIR: ${{ runner.temp }}/natives
        run: bun .github/scripts/mirror-slim-image.ts fetch-natives

      - name: Configure aws credentials
        if: steps.fetch.outputs.count != '0'
        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
        with:
          role-to-assume: arn:aws:iam::${{ vars.CLI_ARTIFACTS_AWS_ACCOUNT_ID }}:role/slim-artifacts-publisher
          # Ties every AssumeRole and PutObject entry in CloudTrail back to one workflow run.
          role-session-name: mirror-slim-image-${{ github.run_id }}
          aws-region: us-east-1

      - name: Upload native artifacts to S3
        if: steps.fetch.outputs.count != '0'
        env:
          SERVICE: ${{ steps.validate.outputs.service }}
          VERSION: ${{ steps.validate.outputs.version }}
          INPUT_DIR: ${{ runner.temp }}/natives
          TARGETS: ${{ steps.fetch.outputs.targets }}
        run: bun .github/scripts/mirror-slim-image.ts upload-natives-s3