Skip to content

added aws ecr upload to rag ingestion workflow #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rootflo-hardik wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

added aws ecr upload to rag ingestion workflow #293

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions .github/workflows/build-rag-ingestion-develop.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ env:
GAR_LOCATION: asia-south1-docker.pkg.dev/aesy-330511/root-hub
IMAGE_NAME: auraflo-rag-ingestion

# AWS_REGION: ap-south-1
# ECR_REGISTRY: 025066241490.dkr.ecr.ap-south-1.amazonaws.com
# ECR_REPOSITORY: rootflo/auraflo-rag-ingestion
AWS_REGION: ap-south-1
ECR_REGISTRY: 025066241490.dkr.ecr.ap-south-1.amazonaws.com
ECR_REPOSITORY: rootflo/auraflo-rag-ingestion

ACR_REGISTRY_NAME: rootflo
ACR_REGISTRY: rootflo.azurecr.io
Expand Down Expand Up @@ -69,21 +69,21 @@ jobs:
docker push ${{ env.GAR_LOCATION }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}

# Configure AWS credentials and push to ECR
# - name: Configure AWS credentials
# uses: aws-actions/configure-aws-credentials@v1
# with:
# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-region: ${{ env.AWS_REGION }}

# - name: Login to Amazon ECR
# id: login-ecr
# uses: aws-actions/amazon-ecr-login@v1

# - name: Tag and push image to Amazon ECR
# run: |
# docker tag rootflo:${{ env.IMAGE_TAG }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
# docker push ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
Comment on lines +72 to +73

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
rg -n "aws-actions/configure-aws-credentials@" .github/workflows -S || true
sed -n '60,90p' .github/workflows/build-rag-ingestion-develop.yaml || true

Repository: rootflo/wavefront

Length of output: 2598

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
rg -n "aws-actions/configure-aws-credentials@" .github/workflows -S || true
sed -n '60,90p' .github/workflows/build-rag-ingestion-develop.yaml || true

Repository: rootflo/wavefront

Length of output: 2598

🌐 Web query:

aws-actions/configure-aws-credentials current major version supported v1 v2 v3 v4 actionlint too old

💡 Result:

As of June 12, 2026, the current major version of the aws-actions/configure-aws-credentials action is v6 [1][2][3]. The action maintains a release policy where major versions (such as v6) receive active updates, while older major versions may no longer be supported or updated [4][5][6]. Using floating tags like @v6 is supported and recommended for convenience, as they automatically point to the latest minor/patch release within that major version [4][6]. Regarding the "actionlint too old" error, this typically occurs because actionlint checks the version of the action used in your workflow file against its own internal database of known, supported, or "modern" actions [7]. If actionlint reports that an action is "too old," it often means: 1. You are referencing an outdated major version (e.g., using v1, v2, or v3 when v6 is available) [5]. 2. Your local version of actionlint itself is outdated and does not recognize newer releases of the action (e.g., it may not be aware that v6 is a valid, current release) [7]. To resolve this: - Update your workflow to use the latest major version, currently @v6 [4][6]. - Ensure your actionlint tool is updated to the latest version to recognize the newest releases [7]. - If you are already using the latest version and still receive the error, check if your actionlint configuration requires an explicit update to its internal rules or if you are using an older, pinned commit SHA that the linter flags as deprecated [8][7].

Citations:

Update deprecated AWS credentials action version before merge

aws-actions/configure-aws-credentials@v1 is an outdated major release; update it to the current supported major (@v6) to avoid actionlint deprecation (“too old”) and potential workflow breakage. (This same @v1 reference appears in other workflows as well.)

🧰 Tools
🪛 actionlint (1.7.12)

[error] 73-73: the runner of "aws-actions/configure-aws-credentials@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.25.2)

[error] 73-73: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-rag-ingestion-develop.yaml around lines 72 - 73,
Replace the deprecated action reference "uses:
aws-actions/configure-aws-credentials@v1" with the current major release "uses:
aws-actions/configure-aws-credentials@v6" in this workflow (and any other
workflows containing the same string); update any input names if the v6 action
requires different parameters and run the workflow lint to ensure no actionlint
deprecations remain.

Source: Linters/SAST tools

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/build-rag-ingestion-develop.yaml"
echo "== File exists? =="
ls -l "$FILE" || true

echo "== Relevant lines (73-90) =="
nl -ba "$FILE" | sed -n '60,95p'

Repository: rootflo/wavefront

Length of output: 270

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/build-rag-ingestion-develop.yaml"
echo "== Relevant lines (70-90) with numbers (cat -n) =="
cat -n "$FILE" | sed -n '65,90p'
echo "== Lines containing configure-aws-credentials in this file =="
rg -n "aws-actions/configure-aws-credentials@" "$FILE" || true
echo "== Lines containing aws-actions/ in this file =="
rg -n "uses: aws-actions/" "$FILE" || true

Repository: rootflo/wavefront

Length of output: 1681

Pin AWS GitHub Action references to immutable commit SHAs (avoid floating tags).
.github/workflows/build-rag-ingestion-develop.yaml uses aws-actions/configure-aws-credentials@v1 (line 73) and aws-actions/amazon-ecr-login@v1 (line 81); pin both to full commit SHAs to prevent supply-chain drift.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 73-73: the runner of "aws-actions/configure-aws-credentials@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.25.2)

[error] 73-73: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-rag-ingestion-develop.yaml at line 73, Replace
floating action tags with immutable commit SHAs: update the two workflow lines
that currently read "uses: aws-actions/configure-aws-credentials@v1" and "uses:
aws-actions/amazon-ecr-login@v1" to reference their full commit SHAs (e.g.,
"aws-actions/configure-aws-credentials@<commit-sha>" and
"aws-actions/amazon-ecr-login@<commit-sha>"); obtain the desired commit SHAs
from the respective repositories' secure releases, commit the updated workflow
file, and ensure both occurrences are pinned to fixed SHAs rather than version
tags.

Source: Linters/SAST tools

with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ env.AWS_REGION }}

- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1

- name: Tag and push image to Amazon ECR
run: |
docker tag rootflo:${{ env.IMAGE_TAG }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
docker push ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}

# Configure Azure credentials and push to ACR
- name: Login to Azure
Expand Down
Loading