gha-registry-push

gha-registry-push

Generates the login, build, and push steps for container registry publishing within a GitHub Actions workflow. This skill is invoked by gha-pipeline-generation when producing the docker-build-push job, or standalone when a user asks to add registry push steps to an existing workflow.

Registry Selection

The registry type is resolved from defaults.registry.type in .devops-agent.json. Approved values are acr (Azure Container Registry) and ecr (AWS Elastic Container Registry). If no config is present, prompt the user to confirm the target registry.

Registry	Login Action	Required Secrets
ACR	azure/docker-login@v1	ACR_USERNAME, ACR_PASSWORD
ECR	aws-actions/configure-aws-credentials@v4 + aws-actions/amazon-ecr-login@v2	AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION

Image Tagging

The primary image tag is always ${{ github.sha }} — a deterministic, immutable reference to the triggering commit. Optionally append a semantic version tag when defaults.registry.semverTag: true is set in config.

Never tag with latest alone in production push steps. The latest tag may be added in addition to the SHA tag but must never be the sole tag.

ACR Push Steps

- name: Login to Azure Container Registry
  uses: azure/docker-login@v1
  with:
    login-server: ${{ env.REGISTRY }}
    username: ${{ secrets.ACR_USERNAME }}
    password: ${{ secrets.ACR_PASSWORD }}
- name: Build Docker image
  run: |
    docker build \
      -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
      .
- name: Push Docker image to ACR
  run: |
    docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

Environment variable prerequisites (top-level env: block):

env:
  REGISTRY: yourorg.azurecr.io
  IMAGE_NAME: ${{ github.repository }}

Required GitHub Secrets:

Secret	Description
ACR_USERNAME	Service principal client ID with AcrPush role
ACR_PASSWORD	Service principal client secret

ECR Push Steps

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: ${{ secrets.AWS_REGION }}
- name: Login to Amazon ECR
  id: login-ecr
  uses: aws-actions/amazon-ecr-login@v2
- name: Build Docker image
  env:
    ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
  run: |
    docker build \
      -t $ECR_REGISTRY/${{ env.IMAGE_NAME }}:${{ github.sha }} \
      .
- name: Push Docker image to ECR
  env:
    ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
  run: |
    docker push $ECR_REGISTRY/${{ env.IMAGE_NAME }}:${{ github.sha }}

Environment variable prerequisites (top-level env: block):

env:
  IMAGE_NAME: ${{ github.repository }}

Required GitHub Secrets:

Secret	Description
AWS_ACCESS_KEY_ID	IAM user or role access key ID with ECR push permissions
AWS_SECRET_ACCESS_KEY	IAM user or role secret access key
AWS_REGION	AWS region where the ECR repository is hosted (e.g., us-east-1)

Dockerfile Path

By default the build step references the Dockerfile in the project root (.). If defaults.docker.dockerfilePath is set in config, use that value as the --file argument:

- name: Build Docker image
  run: |
    docker build \
      --file ${{ env.DOCKERFILE_PATH }} \
      -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
      .

Full Job Example (ACR)

The following is a complete docker-build-push job for ACR, suitable for inline reference when pipeline-generation assembles the workflow:

docker-build-push:
  needs: [build]
  runs-on: [self-hosted, linux, x64]
  steps:
    - uses: actions/checkout@v4
    - name: Login to Azure Container Registry
      uses: azure/docker-login@v1
      with:
        login-server: ${{ env.REGISTRY }}
        username: ${{ secrets.ACR_USERNAME }}
        password: ${{ secrets.ACR_PASSWORD }}
    - name: Build Docker image
      run: |
        docker build \
          -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
          .
    - name: Push Docker image to ACR
      run: |
        docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

Full Job Example (ECR)

docker-build-push:
  needs: [build]
  runs-on: [self-hosted, linux, x64]
  steps:
    - uses: actions/checkout@v4
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ secrets.AWS_REGION }}
    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2
    - name: Build Docker image
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
      run: |
        docker build \
          -t $ECR_REGISTRY/${{ env.IMAGE_NAME }}:${{ github.sha }} \
          .
    - name: Push Docker image to ECR
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
      run: |
        docker push $ECR_REGISTRY/${{ env.IMAGE_NAME }}:${{ github.sha }}