govuk-one-login/Upload Containers to ECR, update references in CF templates

Packages and uploads, replaces reference in (eg) template.yaml

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 9, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: govuk-one-login/devplatform-upload-action-ecr@d839fc3ead8c9d9f18f7a8cceb7ab4a3eab18a58 # v1.7.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
role-to-assume-arn	The secret with the ARN of the role to assume (required) eg secrets.GH_ACTIONS_ROLE_ARN	yes	—
container-sign-kms-key-arn	The secret with the ARN of the key to sign container images e.g. secrets.CONTAINER_SIGN_KMS_KEY	no	none
build-and-push-image-only	Only run docker build, push and signing steps. Skip packaging and artifact uploads	no	false
template-file	The name of the CF template for the application. This defaults to template.yaml	no	template.yaml
working-directory	The working directory containing the app	no	.
artifact-bucket-name	The secret with the name of the artifact S3 bucket (required) eg secrets.ARTIFACT_SOURCE_BUCKET_NAME	yes	—
ecr-repo-name	The secret with the name of the ECR Repo (required) eg secrets.ECR_REPOSITORY	yes	—
dockerfile	The Dockerfile to use for the build	no	Dockerfile
docker-build-path	The Dockerfile path to use for the build	no	—
docker-platform	The target architecture for the image build	no	""
docker-target	The target stage to build in a multi-stage Dockerfile	no	""
checkout-repo	Checks out the repo as the first step of the action. Default "true".	no	true
private-docker-registry	Private Docker registry URL	no	""
private-docker-login-username	Login username to the private docker registry	no	""
private-docker-login-password	Login password to the private docker registry	no	""
push-latest-tag	Float 'latest' tag to the latest image version. This requires tag immutability disabled, a typical use case is test-image-repository containers	no	false
version-number	The version number of the application being deployed. This defaults to ""'	no	""

Outputs

no outputs