Skip to content

Commit d71acaf

Browse files
yyichennyyichenn
authored
feat: release v2 (#520)
* feat: change the default value of mask-password to true BREAKING CHANGE: The default value of the 'mask-password' input has been updated from false to true. * Treat maskPassword as false only if explicitly set to false * Add new-v2-release to README
1 parent 3542211 commit d71acaf

File tree

6 files changed

+19538
-23705
lines changed

6 files changed

+19538
-23705
lines changed

‎README.md

Lines changed: 36 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
66

77
<!-- toc -->
88

9+
- [New v2 Release](#new-v2-release)
910
- [Example of Usage](#examples-of-usage)
1011
- [Building and pushing an image](#building-and-pushing-an-image)
1112
- [Using an image as a service](#using-an-image-as-a-service)
@@ -23,6 +24,28 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
2324

2425
<!-- tocstop -->
2526

27+
## New v2 Release
28+
29+
In the new major version for this action, the default value of the `mask-password` input has changed from `false` to `true`.
30+
31+
If you are **not** consuming the Docker credentials as outputs in subsequent jobs, you can simply update your action version to `aws-actions/amazon-ecr-login@v2`.
32+
33+
For any customer consuming the Docker credentials as outputs in subsequent jobs:
34+
35+
- If you are relying on the default value of the `mask-password` input, which is currently `false` in v1, your workflow will break when upgrading to v2. To fix this, please set the mask-password input to `false`:
36+
37+
```
38+
- name: Login to Amazon ECR
39+
id: login-ecr
40+
uses: aws-actions/amazon-ecr-login@v2
41+
with:
42+
mask-password: 'false'
43+
```
44+
45+
- If you are already setting the `mask-password` input to `false`, you can simply update your action version to `aws-actions/amazon-ecr-login@v2`.
46+
47+
For more information on why this change is being made, see [Masking Docker Credentials in Amazon ECR Login Action](https://github.com/aws-actions/amazon-ecr-login/issues/526).
48+
2649
## Examples of Usage
2750

2851
### Building and pushing an image
@@ -43,9 +66,7 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
4366
```yaml
4467
- name: Login to Amazon ECR
4568
id: login-ecr
46-
uses: aws-actions/amazon-ecr-login@v1
47-
with:
48-
mask-password: 'true'
69+
uses: aws-actions/amazon-ecr-login@v2
4970

5071
- name: Build, tag, and push docker image to Amazon ECR
5172
env:
@@ -61,9 +82,8 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
6182
```yaml
6283
- name: Login to Amazon ECR Public
6384
id: login-ecr-public
64-
uses: aws-actions/amazon-ecr-login@v1
85+
uses: aws-actions/amazon-ecr-login@v2
6586
with:
66-
mask-password: 'true'
6787
registry-type: public
6888

6989
- name: Build, tag, and push docker image to Amazon ECR Public
@@ -81,9 +101,7 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
81101
```yaml
82102
- name: Login to Amazon ECR
83103
id: login-ecr
84-
uses: aws-actions/amazon-ecr-login@v1
85-
with:
86-
mask-password: 'true'
104+
uses: aws-actions/amazon-ecr-login@v2
87105

88106
- name: Package and push helm chart to Amazon ECR
89107
env:
@@ -98,9 +116,8 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
98116
```yaml
99117
- name: Login to Amazon ECR Public
100118
id: login-ecr-public
101-
uses: aws-actions/amazon-ecr-login@v1
119+
uses: aws-actions/amazon-ecr-login@v2
102120
with:
103-
mask-password: 'true'
104121
registry-type: public
105122

106123
- name: Package and push helm chart to Amazon ECR Public
@@ -115,11 +132,6 @@ Logs in the local Docker client to one or more Amazon ECR Private registries or
115132
116133
Helm uses the same credential store as Docker, so Helm can authenticate with the same credentials that you use for Docker.
117134
118-
> [!WARNING]
119-
> Setting `mask-password` to `'true'` is the recommended approach if following any of the examples above.
120-
> However, this will prevent the Docker password output from being shared between separate jobs.
121-
> For more information, see the [Docker Credentials](#docker-credentials) section below.
122-
123135
### Other use-cases
124136
125137
#### Login to ECR on multiple AWS accounts
@@ -133,7 +145,7 @@ Helm uses the same credential store as Docker, so Helm can authenticate with the
133145

134146
- name: Login to Amazon ECR
135147
id: login-ecr
136-
uses: aws-actions/amazon-ecr-login@v1
148+
uses: aws-actions/amazon-ecr-login@v2
137149
with:
138150
registries: "123456789012,998877665544"
139151
```
@@ -149,7 +161,7 @@ for details on how to configure ECR policies
149161
Use the action to output your Docker credentials for logging into ECR Private, then use the credentials to run your private image as a service in another job.
150162

151163
> [!WARNING]
152-
> Not setting `mask-password` or setting `mask-password` to `'false'` will log your Docker password output if [debug logging is enabled](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging).
164+
> Setting `mask-password` to `'false'` will log your Docker password output if [debug logging is enabled](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging).
153165
> For more information, see the [Docker Credentials](#docker-credentials) section below.
154166

155167
```yaml
@@ -165,7 +177,9 @@ jobs:
165177
mask-aws-account-id: 'false'
166178
- name: Login to Amazon ECR
167179
id: login-ecr
168-
uses: aws-actions/amazon-ecr-login@v1
180+
uses: aws-actions/amazon-ecr-login@v2
181+
with:
182+
mask-password: 'false'
169183
outputs:
170184
registry: ${{ steps.login-ecr.outputs.registry }}
171185
docker_username: ${{ steps.login-ecr.outputs.docker_username_123456789012_dkr_ecr_us_east_1_amazonaws_com }} # More information on these outputs can be found below in the 'Docker Credentials' section
@@ -205,7 +219,7 @@ This action relies on the [default behavior of the AWS SDK for Javascript](https
205219
206220
- name: Login to Amazon ECR Private
207221
id: login-ecr
208-
uses: aws-actions/amazon-ecr-login@v1
222+
uses: aws-actions/amazon-ecr-login@v2
209223
```
210224

211225
We recommend following [Amazon IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) when using AWS services in GitHub Actions workflows, including:
@@ -229,10 +243,10 @@ If using ECR Public:
229243
- Docker password output: `docker_password_public_ecr_aws`
230244

231245
> [!IMPORTANT]
232-
> If **you are not** using the Docker credential outputs, make sure the `mask-password` input is **set to `'true'`**.
246+
> If **you are not** using the Docker credential outputs, make sure the `mask-password` input is **not set or set to `'true'`**.
233247
> This masks your Docker password and prevents it from being printed to the action logs if you [enable debug logging](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging).
234248
>
235-
> If **you are** using the Docker credential outputs, make sure the `mask-password` input is **not set or set to `'false'`**.
249+
> If **you are** using the Docker credential outputs, make sure the `mask-password` input is **set to `'false'`**.
236250
> Masked values cannot be passed to separate jobs (see [this issue](https://github.com/actions/runner/issues/1498#issuecomment-1066836352)).
237251

238252
## Self-Hosted Runners
@@ -245,7 +259,7 @@ Additionally, this action will always consider an already configured proxy in th
245259

246260
Proxy configured via action input:
247261
```yaml
248-
uses: aws-actions/amazon-ecr-login@v1.6.0
262+
uses: aws-actions/amazon-ecr-login@v2
249263
with:
250264
http-proxy: "http://companydomain.com:3128"
251265
````

‎action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ inputs:
1414
NOTE: This will prevent the Docker password output from being shared between separate jobs.
1515
Options: ['true', 'false']
1616
required: false
17-
default: 'false'
17+
default: 'true'
1818
registries:
1919
description: >-
2020
A comma-delimited list of AWS account IDs that are associated with the ECR Private registries.

‎dist/cleanup/index.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -626,7 +626,7 @@ class OidcClient {
626626
.catch(error => {
627627
throw new Error(`Failed to get ID Token. \n
628628
Error Code : ${error.statusCode}\n
629-
Error Message: ${error.result.message}`);
629+
Error Message: ${error.message}`);
630630
});
631631
const id_token = (_a = res.result) === null || _a === void 0 ? void 0 : _a.value;
632632
if (!id_token) {

0 commit comments

Comments
 (0)