Repository navigation
feat(ci): build the scratchpad image on a GitHub-hosted runner with OIDC (ENG-2000) - #526
Draft
lucas-koontz wants to merge 2 commits into
Draft
lucas-koontz wants to merge 2 commits into
lucas-koontz wants to merge 2 commits into
Conversation
The scratchpad image build runs on ubuntu-latest and pushes with a short-lived AWS role it assumes through GitHub OIDC. GitHub recommends GitHub-hosted runners for public repositories. - Pull requests name no environment, assume gha-anton-ecr-dev and push to minds-anton-scratchpad-dev. - Staging builds name the staging environment, assume gha-anton-ecr-dev and push to minds-anton-scratchpad-dev. - Main builds name the prod environment, assume gha-anton-ecr-prod and push to minds-anton-scratchpad. The gate job still skips fork pull requests. Its new target step picks the environment, role and repository for each way in, and fails on any other caller input. build-push-ecr runs with builder: local, so the image builds on the runner itself. release.yml and publish-staging.yml grant id-token: write on the calling job only. Third-party actions in the build workflow are pinned by commit. The gate tests run the target step for each way in. They also pin the build job's wiring: the hosted runner, its own id-token grant, the role step before the push, and each caller's grant. A new sweep requires the gate on every job that can mint an OIDC token in a workflow an outside account can start, and the runner sweep now covers the same workflows. The actionlint config that declared the mdb-dev and mdb-prod labels is gone, so actionlint flags any new use of them. The README and the release docs page say where each build lands. Work by Lucas Koontz for "Take the public repos off the credentialed runner group and require devops to release a privileged run". Refs: ENG-2000
This was referenced Oct 4, 2026
Draft
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User story
As an anton maintainer who merges to
stagingandmainI want the scratchpad image to build on a GitHub-hosted runner with an AWS role for its own tier
So that pull requests, staging pushes and releases keep publishing the worker image without a self-hosted runner
Why this matters
When an engineer opens a pull request or merges to
stagingormain, anton builds the scratchpad image, the sandbox pod image. Until now that build ran on a self-hosted runner, although GitHub recommends GitHub-hosted runners for public repositories like this one. Now it runs onubuntu-latestand pushes with a short-lived AWS role that the job assumes through GitHub's OpenID Connect (OIDC) tokens. Pull request and staging images land in a new dev-tier repository,minds-anton-scratchpad-dev, and only a build frommainpushes tominds-anton-scratchpad. The role's AWS account comes from an organization secret, so this public repository names no account id.Test plan
Each line is a test in
tests/test_fork_build_gate.pyunless it says otherwise.gha-anton-ecr-devand pushes tominds-anton-scratchpad-dev.stagingbuilds in thestagingenvironment withgha-anton-ecr-dev. A push tomainbuilds in theprodenvironment withgha-anton-ecr-prodand pushes tominds-anton-scratchpad.AWS_DEV_ACCOUNT_IDorganization secret, both release pipelines pass that secret and no other, and no workflow names an account id.Build skipped: fork pull request.stagingorproductionfails the gate before the build starts.Ships with
Part of ENG-2000.
AWS_DEV_ACCOUNT_IDorganization secret for this repository, and creates itsstagingandprodenvironments:stagingadmits thestagingbranch andprodadmitsmain. Neither environment exists yet.stagingafter our infrastructure change applies and mindsdb/github-actions#71 merges, together with mindsdb/cowork#1117 and mindsdb/cowork-server#621, outside the weekly freeze.