ci: authenticate ECR Public pulls in benchmark workflows (#10056)

* ci: authenticate agent benchmark pulls to ECR Public

Signed-off-by: WenyXu <wenymedia@gmail.com>

* ci: authenticate remaining ECR Public benchmark pulls

Signed-off-by: WenyXu <wenymedia@gmail.com>

---------

Signed-off-by: WenyXu <wenymedia@gmail.com>

.github/workflows/agent-observability.yml

@@ -144,6 +144,18 @@ jobs:
           python3 greptimedb/tests/perf/test_aliyun_ecs_runner_scripts.py
           python3 greptimedb/tests/perf/test_ci_runner_scripts.py
           python3 greptimedb/tests/perf/test_agent_observability_summary.py
+      - name: Configure AWS credentials for ECR Public
+        if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Login to Amazon ECR Public
+        if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registry-type: public
       - name: Check runtime supports shared version-comparison data
         if: inputs.compare_greptimedb
         run: |
@@ -285,6 +297,18 @@ jobs:
           docker info
           # The workspace (and Docker state) must not use a small /tmp filesystem.
           df -h "$GITHUB_WORKSPACE" /var/lib/docker
+      - name: Configure AWS credentials for ECR Public
+        if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Login to Amazon ECR Public
+        if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registry-type: public
       - name: Resolve image tags and verify runtime revision
         shell: bash
         run: |

.github/workflows/oswal-s3-bench.yml

@@ -117,6 +117,18 @@ jobs:
           --timeout-minutes "$BENCHMARK_TIMEOUT_MINUTES" --ttl-hours "$JANITOR_TTL_HOURS"
         python3 greptimedb/.github/scripts/oswal-s3-bench.py image --tag "$GREPTIMEDB_TAG" --image "$GREPTIMEDB_IMAGE_INPUT" \
           --images "$OSWAL_IMAGES"
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Pull every GreptimeDB image and record its version
       id: images
       env:
@@ -200,6 +212,18 @@ jobs:
       run: |
         bash greptimedb/.github/scripts/pull-benchmark-image.sh greptime/minio:2024
         docker compose -f greptimedb/tests-integration/fixtures/docker-compose.yml up -d --wait minio
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Pull and check images, write the plan
       run: |
         bash greptimedb/.github/scripts/oswal-s3-bench-run.sh pull

.github/workflows/tracesbench.yml

@@ -180,6 +180,18 @@ jobs:
           esac
         fi
         python3 greptimedb/.github/scripts/ci-runner-config.py --provider "$PROVIDER" --instance-type "$instance_type"
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Validate budgets and shared runtime
       id: runtime
       run: |
@@ -314,6 +326,18 @@ jobs:
         ref: ${{ env.RESOLVED_O11YBENCH_REF }}
         path: o11ybench
         persist-credentials: false
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Check runner and runtime identity
       id: runtime
       run: |

.github/workflows/vmbench-long-range.yml

@@ -132,6 +132,18 @@ jobs:
       run: |
         python3 greptimedb/tests/perf/test_aliyun_ecs_runner_scripts.py
         python3 greptimedb/tests/perf/test_ci_runner_scripts.py
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Validate budgets and build warm plan
       id: plan
       env:
@@ -279,6 +291,18 @@ jobs:
       with:
         name: ${{ needs.validate.outputs.plan_artifact }}
         path: ${{ env.METADATA_ROOT }}
+    - name: Configure AWS credentials for ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Login to Amazon ECR Public
+      if: startsWith(env.RUNTIME_IMAGE, 'public.ecr.aws/')
+      uses: aws-actions/amazon-ecr-login@v2
+      with:
+        registry-type: public
     - name: Check runner and resolve database images
       run: |
         set -euo pipefail