ci(ric): pull JNI base images via ECR pull-through cache

Author: Fabiana Severin

.github/workflows/release-runtime-interface-client.yml

@@ -40,6 +40,11 @@ env:
   MAVEN_ARGS: "-B --no-transfer-progress"
   AWS_REGION: ${{ vars.AWS_REGION_MAVEN_RELEASE }}
   OIDC_ROLE_ARN: ${{ secrets.AWS_ROLE_MAVEN_RELEASE }}
+  # ECR pull-through cache used for the native JNI base images. ECR_REGISTRY is
+  # the login target; BASE_REGISTRY (with the /ecr-public prefix) is passed to
+  # the Dockerfiles as a build-arg.
+  ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com
+  BASE_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION_MAVEN_RELEASE }}.amazonaws.com/ecr-public
 
 jobs:
   # Build each architecture's native libs (glibc + musl) on a native runner.
@@ -103,6 +108,14 @@ jobs:
           module: ${{ env.MODULE }}
           release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
+      # The native JNI build shells out to `docker build` against the ECR
+      # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so
+      # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds.
+      - name: Log in to Amazon ECR (pull-through cache)
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | docker login --username AWS --password-stdin "$ECR_REGISTRY"
+
       # -DskipTests: only installed so the module compiles, not released here.
       - name: Install intra-repo dependencies
         run: |
@@ -185,6 +198,14 @@ jobs:
           module: ${{ env.MODULE }}
           release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
+      # The native JNI build shells out to `docker build` against the ECR
+      # pull-through cache (see src/main/jni/Dockerfile.*). Authenticate first so
+      # the base-image pulls don't hit public.ecr.aws. Uses ambient runner creds.
+      - name: Log in to Amazon ECR (pull-through cache)
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | docker login --username AWS --password-stdin "$ECR_REGISTRY"
+
       - name: Resolve next development version and tag
         run: |
           # Next development version: use the override, or bump the patch.

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc

@@ -1,4 +1,5 @@
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
+ARG BASE_REGISTRY=public.ecr.aws
+FROM ${BASE_REGISTRY}/amazonlinux/amazonlinux:2
 
 ARG CURL_VERSION
 

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl

@@ -1,4 +1,5 @@
-FROM public.ecr.aws/docker/library/alpine:3
+ARG BASE_REGISTRY=public.ecr.aws
+FROM ${BASE_REGISTRY}/docker/library/alpine:3
 
 ARG CURL_VERSION
 

aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh

@@ -9,6 +9,10 @@ MULTI_ARCH=${2}
 BUILD_OS=${3}
 BUILD_ARCH=${4}
 CURL_VERSION=7.83.1
+# Registry hosting the base images. Defaults to public.ecr.aws for local and
+# GitHub-hosted builds; the release workflow overrides it with the ECR
+# pull-through cache so egress-locked runners don't hit public.ecr.aws.
+BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
 
 function get_docker_platform() {
   arch=$1
@@ -45,7 +49,7 @@ function build_for_libc_arch() {
 
   if [[ "${MULTI_ARCH}" == "true" ]]; then
       docker build --platform="${docker_platform}" -f "${SRC_DIR}/Dockerfile.${libc_impl}" \
-            --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" -o - \
+            --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" -o - \
       | tar -xOf - src/aws-lambda-runtime-interface-client.so > "${artifact}"
   else
       echo "multi-arch not requested, assuming this is a workaround to goofyness when docker buildx is enabled on Linux CI environments."
@@ -63,7 +67,7 @@ function build_for_libc_arch() {
       docker build --platform="${docker_platform}" \
             -t "${image_name}" \
             -f "${SRC_DIR}/Dockerfile.${libc_impl}" \
-            --build-arg CURL_VERSION=${CURL_VERSION} "${SRC_DIR}" ${EXTRA_LOAD_ARG}
+            --build-arg CURL_VERSION=${CURL_VERSION} --build-arg BASE_REGISTRY=${BASE_REGISTRY} "${SRC_DIR}" ${EXTRA_LOAD_ARG}
 
       echo "Docker image has been successfully built"