GitHub Actions/semantic-release を使ったGitHubタグとAmazon ECRイメージタグを連携するセマンティックバージョニング術

name: bump version and publish

on:
  workflow_dispatch

env:
  AWS_REGION: ap-northeast-1
  ECR_REPOSITORY: your-ecr-repository-name
  TFSTATE_BUCKET: your-s3-bucket-name
  TFSTATE_BUCKET_PATH: your-app/prod
  ROLE_ARN: arn:aws:iam::123456789012:role/GitHubOIDCActions

permissions:
  contents: write
  id-token: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.ROLE_ARN }}
          role-session-name: gh-oidc-${{ github.run_id }}-${{ github.run_attempt}}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Bump version and push tag
        id: tag-version
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag-version.outputs.new_tag }}
          name: Release ${{ steps.tag-version.outputs.new_tag }}
          body: ${{ steps.tag-version.outputs.changelog }}

      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        uses: docker/build-push-action@v6
        with:
          tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.tag-version.outputs.new_tag }}
          context: .
          push: true

      - uses: kayac/ecspresso@v2
        with:
          version: v2.4.5

      - name: ecspresso validate
        id: task-validate
        env:
          IMAGE_TAG: ${{ steps.tag-version.outputs.new_tag }}
        run: |
          ecspresso verify

      - name: ecspresso deploy
        id: task-deploy
        env:
          IMAGE_TAG: ${{ steps.tag-version.outputs.new_tag }}
        run: |
          ecspresso deploy

{
  "containerDefinitions": [
    {
      "cpu": 128,
      "image": "{{ tfstate `module.frontend-ecr.aws_ecr_repository.myecr.repository_url` }}:{{ must_env `IMAGE_TAG` }}",
      ...

$ git log --oneline
f0b4dc1 (HEAD -> main, tag: v3.0.0, origin/main, origin/HEAD) perf: test
cad45c2 feat: test
c839cd2 fix: test
088f872 (tag: v2.2.0) fix: Update README.md
862e0be feat: Update release.yml
24c84b8 (tag: v2.1.5) fix: Update README.md
a4e227a (tag: v2.1.4) fix: Update README.md

    - name: Bump version and push tag
      id: tag-version
      uses: mathieudutour/github-tag-action@v6.2
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}

     - name: Build, tag, and push image to Amazon ECR
      id: build-image
      uses: docker/build-push-action@v6
      with:
        tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.tag-version.outputs.new_tag }}
        context: .
        push: true

      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag-version.outputs.new_tag }}
          name: Release ${{ steps.tag-version.outputs.new_tag }}
          body: ${{ steps.tag-version.outputs.changelog }}