pre-oidc-orb_v2.30.txt

version: 2.1
description: "Opinionated commands for releasing OOT projects on AWS EKS via ECR."

orbs:
  aws-cli: circleci/aws-cli@1.4.1
  aws-ecr: circleci/aws-ecr@6.15.3
  snyk: snyk/snyk@1.1.2

commands:
  push-image:
    description: "Builds, scans and pushes a new service to ECR."
    parameters:
      service:
        description: "The name of the service that will be deployed. This will be used to build up the image name."
        type: string
      access-key-name:
        description: "The name of the environment variable that will be used to provide the AWS access key id."
        type: string
        default: ACCESS_KEY_ID
      secret-access-key-name:
        description: "The name of the environment variable that will be used to provide the AWS secret access key."
        type: string
        default: SECRET_ACCESS_KEY
      account:
        description: "The numeric identifier for the AWS account on which the operation will be run."
        type: string
        default: ${AWS_ACCOUNT}
      region:
        description: "The AWS region on which the operation will be run."
        type: string
        default: eu-west-1
      extra-build-args:
        description: "Extra arguments to pass when running docker build"
        type: string
        default: ""
      image-tag:
        description: "Tag to push the image with"
        type: string
        default: ${CIRCLE_SHA1}
      extra-image-tags:
        description: "Extra tags to push the image with, these will not be snyk scanned"
        type: string
        default: latest

    steps:
      - attach_workspace:
          at: .

      - run:
          command: |
            echo "export AWS_DEFAULT_REGION=<< parameters.region >>" >> $BASH_ENV
            echo "export AWS_REGION=eu-west-1" >> $BASH_ENV
            echo "export AWS_ECR_ACCOUNT_URL=<< parameters.account >>.dkr.ecr.<< parameters.region >>.amazonaws.com" >> $BASH_ENV

      - aws-cli/install
      - aws-cli/setup:
          aws-access-key-id: << parameters.access-key-name >>
          aws-secret-access-key: << parameters.secret-access-key-name >>

      - aws-ecr/build-image:
          account-url: AWS_ECR_ACCOUNT_URL
          aws-access-key-id: << parameters.access-key-name >>
          aws-secret-access-key: << parameters.secret-access-key-name >>
          repo: << parameters.service >>
          tag: << parameters.image-tag >>,<< parameters.extra-image-tags >>
          ecr-login: true
          extra-build-args: << parameters.extra-build-args >>

      - snyk/scan:
          monitor-on-build: true
          severity-threshold: high
          fail-on-issues: false
          target-file: Dockerfile
          docker-image-name: $AWS_ECR_ACCOUNT_URL/<< parameters.service >>:<< parameters.image-tag >>

      - aws-ecr/push-image:
          repo: << parameters.service >>
          tag: << parameters.image-tag >>,<< parameters.extra-image-tags >>

executors:
  aws:
    machine:
      image: ubuntu-2004:202201-02