ci: also push web app image to GCP Artifact Registry

[Dan Jake Neal (DanJakeNeal)]

Summary

Pushes the web app image to the GCP Artifact Registry as well as ghcr.io, so deployments can pull from the same registry as every other Acquired service instead of relying on images being copied across by hand.

• Authenticates to GCP via workload identity federation using the repository's WIF_PROVIDER_NAME and SERVICE_ACCOUNT_EMAIL secrets.
• Adds the Artifact Registry path as a second image in the Docker metadata step, so one build is pushed to both registries.
• Keeps the existing workflow_dispatch version input, image naming and multi-arch behaviour unchanged.

Jira: A2A-279

Details for AI reviewers

Files

• .github/workflows/open-banking-connector-web-app-docker-image.yml — 21 lines added, 1 changed.

Changes

• Two new env entries, GCP_REGISTRY and GCP_IMAGE_NAME, pointing at europe-west2-docker.pkg.dev/prj-c-prd-infra-cicd-iytq/ar-c-prd-euwe2-docker/open-banking-connector-web-app.
• id-token: write added to the job permissions, required for workload identity federation.
• A google-github-actions/auth step requesting token_format: access_token, followed by a docker/login-action against Artifact Registry using oauth2accesstoken.
• The metadata action's images input becomes a two-line list, so build-push-action receives both tags and pushes a single build to both registries.

Naming

The Artifact Registry path uses open-banking-connector-web-app, matching both the ghcr.io image name and the existing repository in Artifact Registry that already holds 18.2.0. It deliberately does not use ${{ github.event.repository.name }} the way payment-service does, since that would resolve to open-banking-connector and start a separate repository.

Why not the shared template

acquired-pci/dotnet-github-action-templates was considered. It derives the version from src/*/*.csproj via xmlstarlet, and this repository has five projects carrying a <Version>, so that step returns multiple values. It also pushes unconditionally to Docker Hub and runs Docker Scout, requiring secrets this repository does not have. Extending the existing workflow was the smaller change.

Dependencies

Requires acquired-pci/gcp-projects PR #254 to be applied, which provisions the service account, the WIF binding scoped to this repository, the three Actions secrets, and roles/artifactregistry.admin on the registry. The auth step fails without it.

Fork divergence

This is the fork's first content change on top of upstream, and the file is upstream-owned. Future syncs may conflict here. Upstream rarely touches this workflow, so the risk was judged acceptable against the alternative of a separate mirror workflow requiring a second manual step per release.

Verification

Validated with actionlint 1.7 (via rhysd/actionlint Docker image), clean. Not yet executed, since it cannot authenticate until #254 is applied.

Note on auth@v2

The shared template pins google-github-actions/auth@v1. This uses @v2 instead, as v1 is deprecated and pinned to an EOL Node runtime.

[Copilot]

Pull request overview

Updates the web-app Docker image publishing workflow to push the same multi-arch build to both GitHub Container Registry (ghcr.io) and Google Cloud Artifact Registry, using GitHub OIDC workload identity federation for GCP authentication.

Changes:

• Adds GCP Artifact Registry image coordinates via new workflow env variables.
• Enables OIDC (id-token: write) and authenticates to Google Cloud using google-github-actions/auth.
• Logs in to Artifact Registry and configures docker/metadata-action to emit tags for both registries so a single build is pushed to both.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.