ecs_deploy 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ada66f2f084f7ea0e30b0b6808d2635480db1071ae13acfc16f6f7d4cc02fef
-  data.tar.gz: 2188aa1ed3727d1c7719bca93006383b831a6f6379ffa28b08aee8a97d5281e5
+  metadata.gz: ffd7f96436519805879cb2793cffbe33cf991a6f17109904f014cf35b5f51fe8
+  data.tar.gz: 8085faa308fe594cab25202e3cefbcddca7553775b0bd484f4c5ecdfc5db95f5
 SHA512:
-  metadata.gz: a3e3f662af6586e71f002853a3599adb107c7db5b8b44c4d7ce3d8d13c6d37ae2210ec9a0a0749813e926f78c4879a3a72d851f6dfd2c466e8ec296a9900f244
-  data.tar.gz: f96818f250b0644a3908822fa741b26bba564095feff3d78e9a28acc30baa9da5b435200d3c2bc83edf4a2e3e7b73e48e5702ade9f1f3ac7c614be1a9402a067
+  metadata.gz: dc6488543f3b0ca040de988a5a2e8df5241ed0c01e2f7e11ad52fce9450f0a9d967685202718c9db87ee4834062faad002d0e17adb7e0b6262a5710f1eeaecf7
+  data.tar.gz: b5a11acbafb0b6153961f91b4ef6237248ba484f055fea5092b03cf9f1f70f25519fca19629dd3e72cad44f8bcc349137bee6fcbb64bf0d52a6b5e91d74d5f56

data/.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Ruby
-        uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true

data/README.md

@@ -30,10 +30,13 @@ set :ecs_deploy_wait_timeout, 600 # default: 300
 set :ecs_wait_until_services_stable_max_attempts, 40 # optional
 set :ecs_wait_until_services_stable_delay, 15 # optional
 set :ecs_client_params, { retry_mode: "standard", max_attempts: 10 } # default: {}
+set :ecs_docker_buildx_env, { "DOCKER_CONFIG" => "/path/to/docker/config" } # optional. Env vars for the `docker buildx` command used by use_digest. Merged with each task's docker_buildx_env (the per-task one takes precedence). default: {}
 
 set :ecs_tasks, [
   {
     name: "myapp-#{fetch(:rails_env)}",
+    use_digest: true, # optional. When true, each container_definitions[].image is rewritten to a digest reference (registry/repo@sha256:...) resolved via `docker buildx imagetools inspect` at registration time. Requires the `docker` CLI with buildx on the deploy host; resolution failure aborts the deploy.
+    docker_buildx_env: { "DOCKER_CONFIG" => "/path/to/docker/config" }, # optional. Env vars for the `docker buildx` command. Merged on top of :ecs_docker_buildx_env.
     container_definitions: [
       {
         name: "myapp",

data/lib/ecs_deploy/capistrano.rb

@@ -11,6 +11,7 @@ namespace :ecs do
       c.ecs_wait_until_services_stable_max_attempts = fetch(:ecs_wait_until_services_stable_max_attempts) if fetch(:ecs_wait_until_services_stable_max_attempts)
       c.ecs_wait_until_services_stable_delay = fetch(:ecs_wait_until_services_stable_delay) if fetch(:ecs_wait_until_services_stable_delay)
       c.ecs_client_params = fetch(:ecs_client_params) if fetch(:ecs_client_params)
+      c.docker_buildx_env = fetch(:ecs_docker_buildx_env) if fetch(:ecs_docker_buildx_env)
     end
 
     if ENV["TARGET_CLUSTER"]
@@ -32,6 +33,8 @@ namespace :ecs do
           task_definition = EcsDeploy::TaskDefinition.new(
             region: region,
             task_definition_name: t[:name],
+            use_digest: t[:use_digest],
+            docker_buildx_env: t[:docker_buildx_env],
             container_definitions: t[:container_definitions],
             task_role_arn: t[:task_role_arn],
             execution_role_arn: t[:execution_role_arn],

data/lib/ecs_deploy/configuration.rb

@@ -9,7 +9,8 @@ module EcsDeploy
       :ecs_service_role,
       :ecs_wait_until_services_stable_max_attempts,
       :ecs_wait_until_services_stable_delay,
-      :ecs_client_params
+      :ecs_client_params,
+      :docker_buildx_env
 
     def initialize
       @log_level = :info
@@ -18,6 +19,7 @@ module EcsDeploy
       @ecs_wait_until_services_stable_max_attempts = 40
       @ecs_wait_until_services_stable_delay = 15
       @ecs_client_params = {}
+      @docker_buildx_env = {}
     end
   end
 end

data/lib/ecs_deploy/task_definition.rb

@@ -1,5 +1,18 @@
+require "open3"
+
 module EcsDeploy
   class TaskDefinition
+    DIGEST_SUFFIX = /@sha256:[0-9a-f]{64}\z/
+    DIGEST_FORMAT = /\Asha256:[0-9a-f]{64}\z/
+
+    # Process-wide cache of resolved digests keyed by image reference,
+    # so the same image is only inspected via docker once per process.
+    @digest_cache = {}
+
+    class << self
+      attr_reader :digest_cache
+    end
+
     def self.deregister(arn, region: nil)
       region ||= EcsDeploy.config.default_region
       params ||= EcsDeploy.config.ecs_client_params
@@ -10,8 +23,12 @@ module EcsDeploy
       EcsDeploy.logger.info "deregistered task definition [#{arn}] [#{client.config.region}] [#{Paint['OK', :green]}]"
     end
 
-    def initialize(task_definition_name:, region: nil, **options)
+    def initialize(task_definition_name:, region: nil, use_digest: false, docker_buildx_env: nil, **options)
       @task_definition_name = task_definition_name
+      @use_digest = use_digest
+      @docker_buildx_env = (EcsDeploy.config.docker_buildx_env || {})
+        .merge(docker_buildx_env || {})
+        .map { |k, v| [k.to_s, v&.to_s] }.to_h
       region ||= EcsDeploy.config.default_region
       params ||= EcsDeploy.config.ecs_client_params
 
@@ -49,11 +66,61 @@ module EcsDeploy
     end
 
     def register
-      res = @client.register_task_definition(
-        @options.merge(family: @task_definition_name)
-      )
+      options = @options.merge(family: @task_definition_name)
+      options[:container_definitions] = apply_digests(options[:container_definitions]) if @use_digest
+      res = @client.register_task_definition(options)
       EcsDeploy.logger.info "registered task definition [#{@task_definition_name}] [#{@region}] [#{Paint['OK', :green]}]"
       res.task_definition
     end
+
+    private
+
+    def apply_digests(container_definitions)
+      (container_definitions || []).map do |cd|
+        image = cd[:image]
+        next cd if image.nil? || image.empty?
+
+        resolved = resolve_image_with_digest(image)
+        EcsDeploy.logger.info "resolved image [#{image}] -> [#{resolved}]" if resolved != image
+        cd.merge(image: resolved)
+      end
+    end
+
+    def resolve_image_with_digest(image)
+      return image if image =~ DIGEST_SUFFIX
+
+      "#{repository_without_tag(image)}@#{fetch_manifest_digest(image)}"
+    end
+
+    # "registry:5000/ns/repo:tag" -> "registry:5000/ns/repo"
+    # "registry:5000/ns/repo"     -> "registry:5000/ns/repo"
+    # "repo:tag"                  -> "repo"
+    def repository_without_tag(image)
+      name_start = (idx = image.rindex("/")) ? idx + 1 : 0
+      colon = image.index(":", name_start)
+      colon ? image[0...colon] : image
+    end
+
+    def fetch_manifest_digest(image)
+      cache = self.class.digest_cache
+      if (cached = cache[image])
+        EcsDeploy.logger.debug "using cached digest for #{image}: #{cached}"
+        return cached
+      end
+
+      EcsDeploy.logger.debug "docker buildx imagetools inspect --format '{{.Manifest.Digest}}' #{image}"
+      stdout, stderr, status =
+        Open3.capture3(@docker_buildx_env, "docker", "buildx", "imagetools", "inspect", "--format", "{{.Manifest.Digest}}", image)
+      unless status.success?
+        raise EcsDeploy::Error, "docker buildx imagetools inspect failed for '#{image}': #{stderr.strip}"
+      end
+      digest = stdout.strip
+      unless digest =~ DIGEST_FORMAT
+        raise EcsDeploy::Error, "Unexpected digest for '#{image}': #{digest.inspect}"
+      end
+      cache[image] = digest
+    rescue Errno::ENOENT => e
+      raise EcsDeploy::Error, "docker command not found: #{e.message}"
+    end
   end
 end

data/lib/ecs_deploy/version.rb

@@ -1,3 +1,3 @@
 module EcsDeploy
-  VERSION = "2.0.0"
+  VERSION = "2.1.0"
 end

data/lib/ecs_deploy.rb

@@ -7,6 +7,8 @@ require 'terminal-table'
 require 'paint'
 
 module EcsDeploy
+  class Error < StandardError; end
+
   def self.logger
     @logger ||= Logger.new(STDOUT).tap do |l|
       l.level = Logger.const_get(config.log_level.to_s.upcase)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ecs_deploy
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - joker1007