use inline vars for ecr

Author: blink1073

git-sign/action.yml

@@ -4,6 +4,9 @@ inputs:
   command:
     description: "Command to run inside the container"
     required: true
+  ecr_registry:
+    description: "The ECR registry to use"
+    default: "901841024863.dkr.ecr.us-east-1.amazonaws.com"
   ecr_repository:
     description: "The ECR repository to use"
     default: release-infrastructure/garasign-git
@@ -12,13 +15,16 @@ runs:
   using: composite
   steps:
     - name: "Run git command"
+      env:
+        ECR_REGISTRY: ${{ inputs.ecr_registry }}
+        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
       run: |
         WORKING_DIR=/home/git-checkout
         docker run \
           --env-file=$GARASIGN_ENVFILE \
           --rm \
           -v $(pwd):$WORKING_DIR \
           -w $WORKING_DIR \
-          ${ECR_REGISTRY}/${{ inputs.ecr_repository }} \
+          ${ECR_REGISTRY}/${ECR_REPOSITORY} \
           /bin/bash -c "git config --global --add safe.directory $WORKING_DIR && gpgloader && ${{ inputs.command }}"
       shell: bash

gpg-sign/action.yml

@@ -4,6 +4,9 @@ inputs:
   filenames:
     description: "File name(s) to sign, can be a glob pattern"
     required: true
+  ecr_registry:
+    description: "The ECR registry to use"
+    default: "901841024863.dkr.ecr.us-east-1.amazonaws.com"
   ecr_repository:
     description: "The ECR repository to use"
     default: release-infrastructure/garasign-git
@@ -23,13 +26,16 @@ runs:
           echo "names=\"$FILENAMES\"" >> $GITHUB_OUTPUT
     - name: "Create detached signature for file"
       shell: bash
+      env:
+        ECR_REGISTRY: ${{ inputs.ecr_registry }}
+        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
       run: |
         docker run \
           --env-file=$GARASIGN_ENVFILE \
           --rm \
           -v $(pwd):$(pwd) \
           -w $(pwd) \
-          ${ECR_REGISTRY}/${{ inputs.ecr_repository }} \
+          ${ECR_REGISTRY}/${ECR_REPOSITORY} \
           /bin/bash -c 'gpgloader && for filename in ${{ inputs.filenames }}; do gpg --detach-sign --armor --output ${filename}.sig ${filename}; done'
 
     - name: "Move the signature files to the release directory"

sbom/action.yml

@@ -10,6 +10,9 @@ inputs:
   kondukto_sub_project:
     description: The Kondukto sub-project name (appended to the branch name)
     required: false
+  ecr_registry:
+    description: "The ECR registry to use"
+    default: "901841024863.dkr.ecr.us-east-1.amazonaws.com"
   ecr_repository:
     description: "The ECR repository to use"
     default: release-infrastructure/silkbomb:2.0
@@ -22,6 +25,7 @@ runs:
       env:
         SBOM_IN_PATH: ${{ inputs.sbom_in_path }}
         KONDUKTO_SUB_PROJECT: ${{ inputs.kondukto_sub_project }}
+        ECR_REGISTRY: ${{ inputs.ecr_registry }}
         ECR_REPOSITORY: ${{ inputs.ecr_repository }}
         SBOM_FILE_NAME: ${{ inputs.sbom_file_name }}
       run: |

setup/action.yml

@@ -10,9 +10,15 @@ inputs:
   aws_secret_id:
     description: "The name of the aws secret to use"
     required: true
-  ecr_registry:
-    description: "The ECR registry to use"
+  ecr_registry_id:
+    description: "The ECR registry id to use"
     default: "901841024863"
+  ecr_role_arn:
+    description: "The ECR role arn to use"
+    default: "arn:aws:iam::901841024863:role/ecr-role-gha-ro"
+  ecr_region:
+    description: "The ECR region to use"
+    default: us-east-1
 
 runs:
   using: composite
@@ -38,10 +44,10 @@ runs:
   - name: configure aws credentials for ECR
     uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
     with:
-      role-to-assume: ${{ env.ECR_ROLE_ARN }}
+      role-to-assume: ${{ inputs.ecr_role_arn }}
       role-session-name: release-session
-      aws-region: ${{ env.ECR_REGION }}
+      aws-region: ${{ inputs.ecr_region }}
   - name: Log in to ECR
     uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2
     with:
-      registries: "${{ env.ECR_REGISTRY_ID }}"
+      registries: "${{ inputs.ecr_registry_id }}"

setup/setup.sh

@@ -49,10 +49,6 @@ GPG_PUBLIC_URL=${GPG_PUBLIC_URL:-}
 GARASIGN_ENVFILE=$GARASIGN_ENVFILE
 SILKBOMB_ENVFILE=${SILKBOMB_ENVFILE:-}
 KONDUKTO_ENVFILE=${KONDUKTO_ENVFILE:-}
-ECR_REGISTRY_ID=${ECR_REGISTRY_ID}
-ECR_REGISTRY=${ECR_REGISTRY_ID}.dkr.ecr.${ECR_REGION}.amazonaws.com
-ECR_ROLE_ARN=${ECR_ROLE_ARN}
-ECR_REGION=${ECR_REGION}
 RELEASE_ASSETS=$RELEASE_ASSETS
 S3_ASSETS=$S3_ASSETS
 SECURITY_REPORT_URL=${SECURITY_REPORT_URL:-}