From cbc5d841177fa8fcaec315e96a5ac5f23c70408f Mon Sep 17 00:00:00 2001
From: Mike Heffner <mikeh@fesnel.com>
Date: Sun, 2 Aug 2026 21:54:31 -0400
Subject: [PATCH] ci: push python-processor images to public ECR

Mirrors the clickhouse-ddl public ECR job: assumes an OIDC role from the
AWS_ECR_PUBLIC_PYTHON_PROCESSORS_ROLE_ARN secret and pushes multi-arch
images to public.ecr.aws/rotel-dev/python-processors.
---
 .github/workflows/processor-release.yml | 57 +++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.github/workflows/processor-release.yml b/.github/workflows/processor-release.yml
index 34b10b63..efae54b8 100644
--- a/.github/workflows/processor-release.yml
+++ b/.github/workflows/processor-release.yml
@@ -165,6 +165,63 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.python-processor
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  docker-push-ecr:
+    name: docker push (public ECR)
+    runs-on: ubuntu-latest
+    needs: [ release ]
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: download rotel builds
+        uses: actions/download-artifact@v4
+        with:
+          pattern: rotel-processor-build-*
+          merge-multiple: true
+          path: target
+
+      - name: Position binaries by docker arch name
+        run: |
+          mkdir -p target/amd64 && cp target/x86_64-unknown-linux-gnu/release/rotel target/amd64/ && \
+          mkdir -p target/arm64 && cp target/aarch64-unknown-linux-gnu/release/rotel target/arm64/
+
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ECR_PUBLIC_PYTHON_PROCESSORS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Login to public ECR
+        run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
+
+      # configure build / push targets
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            public.ecr.aws/rotel-dev/python-processors
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with: