ecs retag

Author: CLJ2006

ansible/roles/deploy-ecs-proxies/tasks/main.yml

@@ -82,27 +82,41 @@
       register: tfapply
       when: not do_not_terraform
 
-    - name: Retag and promote ECS image (release pipelines only)
-      # when: pr_number is not defined or pr_number == ""
+    - name: Retag ECS image using ECR API (release pipelines only)
+      when: lookup('env', 'RELEASE_RELEASEID') | length > 0
       vars:
-        PTL_REG: "{{ PTL_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com"
-        PROD_REG: "{{ PROD_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com"
-        IMG: "{{ service_id }}_{{ ecs_service[0].name }}"
-        TAG: "{{ build_label }}"
+        # Choose PTL for lower envs, PROD for prod
+        TARGET_ACCOUNT: >-
+          {{
+            (apigee_environment == "prod")
+            | ternary(PROD_ACCOUNT_ID, PTL_ACCOUNT_ID)
+          }}
+        REPO: "{{ service_id }}_{{ ecs_service[0].name }}"
+        OLD: "{{ build_label }}"
         NEW: "ecs-{{ build_label }}"
       shell: |
-        aws ecr get-login-password --region eu-west-2 \
-          | docker login --username AWS --password-stdin {{ PTL_REG }}
-
-        docker pull {{ PTL_REG }}/{{ IMG }}:{{ TAG }}
-        docker tag {{ PTL_REG }}/{{ IMG }}:{{ TAG }} {{ PTL_REG }}/{{ IMG }}:{{ NEW }}
-        docker push {{ PTL_REG }}/{{ IMG }}:{{ NEW }}
-
-        aws ecr get-login-password --region eu-west-2 \
-          | docker login --username AWS --password-stdin {{ PROD_REG }}
-
-        docker tag {{ PTL_REG }}/{{ IMG }}:{{ NEW }} {{ PROD_REG }}/{{ IMG }}:{{ NEW }}
-        docker push {{ PROD_REG }}/{{ IMG }}:{{ NEW }}
+        # 1. Fetch manifest from the SAME account (PTL for lower envs, PROD for prod)
+        MANIFEST=$(aws ecr batch-get-image \
+          --region eu-west-2 \
+          --registry-id {{ TARGET_ACCOUNT }} \
+          --repository-name {{ REPO }} \
+          --image-ids imageTag={{ OLD }} \
+          --query 'images[0].imageManifest' \
+          --output text)
+
+        # Safety check: ensure the base tag exists
+        if [ -z "$MANIFEST" ]; then
+          echo "ERROR: Tag {{ OLD }} does not exist in account {{ TARGET_ACCOUNT }}"
+          exit 1
+        fi
+
+        # 2. Write the new tag into the SAME account
+        aws ecr put-image \
+          --region eu-west-2 \
+          --registry-id {{ TARGET_ACCOUNT }} \
+          --repository-name {{ REPO }} \
+          --image-tag {{ NEW }} \
+          --image-manifest "$MANIFEST"
       args:
         executable: /bin/bash