From 8ecf49dca017adf873d31f7d4e6f01ebd4cef1cb Mon Sep 17 00:00:00 2001 From: Weny Xu Date: Thu, 29 Oct 2026 19:16:19 +0000 Subject: [PATCH] ci: authenticate ECR Public pulls in benchmark workflows (#10056) * ci: authenticate agent benchmark pulls to ECR Public Signed-off-by: WenyXu * ci: authenticate remaining ECR Public benchmark pulls Signed-off-by: WenyXu --------- Signed-off-by: WenyXu --- .github/workflows/agent-observability.yml | 24 +++++++++++++++++++++++ .github/workflows/oswal-s3-bench.yml | 24 +++++++++++++++++++++++ .github/workflows/tracesbench.yml | 24 +++++++++++++++++++++++ .github/workflows/vmbench-long-range.yml | 24 +++++++++++++++++++++++ 4 files changed, 96 insertions(+) diff --git a/.github/workflows/agent-observability.yml b/.github/workflows/agent-observability.yml index d265801d4a0..90840536594 100644 --- a/.github/workflows/agent-observability.yml +++ b/.github/workflows/agent-observability.yml @@ -144,6 +144,18 @@ jobs: python3 greptimedb/tests/perf/test_aliyun_ecs_runner_scripts.py python3 greptimedb/tests/perf/test_ci_runner_scripts.py python3 greptimedb/tests/perf/test_agent_observability_summary.py + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Check runtime supports shared version-comparison data if: inputs.compare_greptimedb run: | @@ -285,6 +297,18 @@ jobs: docker info # The workspace (and Docker state) must not use a small /tmp filesystem. df -h "$GITHUB_WORKSPACE" /var/lib/docker + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Resolve image tags and verify runtime revision shell: bash run: | diff --git a/.github/workflows/oswal-s3-bench.yml b/.github/workflows/oswal-s3-bench.yml index e61754cb1f1..92243c89e58 100644 --- a/.github/workflows/oswal-s3-bench.yml +++ b/.github/workflows/oswal-s3-bench.yml @@ -117,6 +117,18 @@ jobs: --timeout-minutes "$BENCHMARK_TIMEOUT_MINUTES" --ttl-hours "$JANITOR_TTL_HOURS" python3 greptimedb/.github/scripts/oswal-s3-bench.py image --tag "$GREPTIMEDB_TAG" --image "$GREPTIMEDB_IMAGE_INPUT" \ --images "$OSWAL_IMAGES" + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Pull every GreptimeDB image and record its version id: images env: @@ -200,6 +212,18 @@ jobs: run: | bash greptimedb/.github/scripts/pull-benchmark-image.sh greptime/minio:2024 docker compose -f greptimedb/tests-integration/fixtures/docker-compose.yml up -d --wait minio + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Pull and check images, write the plan run: | bash greptimedb/.github/scripts/oswal-s3-bench-run.sh pull diff --git a/.github/workflows/tracesbench.yml b/.github/workflows/tracesbench.yml index 049faaef1a7..fd64ebfcf37 100644 --- a/.github/workflows/tracesbench.yml +++ b/.github/workflows/tracesbench.yml @@ -180,6 +180,18 @@ jobs: esac fi python3 greptimedb/.github/scripts/ci-runner-config.py --provider "$PROVIDER" --instance-type "$instance_type" + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Validate budgets and shared runtime id: runtime run: | @@ -314,6 +326,18 @@ jobs: ref: ${{ env.RESOLVED_O11YBENCH_REF }} path: o11ybench persist-credentials: false + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Check runner and runtime identity id: runtime run: | diff --git a/.github/workflows/vmbench-long-range.yml b/.github/workflows/vmbench-long-range.yml index aaf2dd7f437..d4e3ad124c1 100644 --- a/.github/workflows/vmbench-long-range.yml +++ b/.github/workflows/vmbench-long-range.yml @@ -132,6 +132,18 @@ jobs: run: | python3 greptimedb/tests/perf/test_aliyun_ecs_runner_scripts.py python3 greptimedb/tests/perf/test_ci_runner_scripts.py + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Validate budgets and build warm plan id: plan env: @@ -279,6 +291,18 @@ jobs: with: name: ${{ needs.validate.outputs.plan_artifact }} path: ${{ env.METADATA_ROOT }} + - name: Configure AWS credentials for ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }} + aws-region: us-east-1 + - name: Login to Amazon ECR Public + if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/') + uses: aws-actions/amazon-ecr-login@v2 + with: + registry-type: public - name: Check runner and resolve database images run: | set -euo pipefail