no basic auth credentials on push_image step

[hylaride]

Orb version

9.0.4 (Though this broke for me in 9.0.3 - 9.0.2 functions properly)

What happened

push_image now fails on docker push to ECR with the following error:

a9db2aea91b3: Preparing 
2cea05c6512a: Preparing 
5498e8c22f69: Waiting 
no basic auth credentials

Exited with code exit status 1

Expected behavior

Docker login should happen as before. This is our orb instantiation:

  steps:
    - setup_remote_docker
    - run:
        name: Get 7 digit git sha1
        command: |
          echo 'export SMALL_SHA="${CIRCLE_SHA1:0:7}"' >> "$BASH_ENV"
    - aws-ecr/build_and_push_image:
        auth:
          - aws-cli/setup:
              role_arn: $ECR_OID_ACCESS_ARN
              role_session_name: ecr-login
              profile_name: << parameters.repo >>-ecr-login
        profile_name: << parameters.repo >>-ecr-login
        account_id: "$AWS_ECR_REGISTRY_ID"
        no_output_timeout: << parameters.no-output-timeout >>
        region: << parameters.region >>
        repo: << parameters.repo >>
        skip_when_tags_exist: << parameters.skip-when-tags-exist >>
        tag: ${SMALL_SHA}
        path: << parameters.path >>
        push_image: false
    - aws-ecr/push_image:
        region: << parameters.region >>
        account_id: "$AWS_ECR_REGISTRY_ID"
        repo: << parameters.repo >>
        tag: ${SMALL_SHA}

I suspect this pull request is the culprit. is there anything I need to change on my end to get the aws-ecr/push_image step to work?

[hylaride]

I should also add that the reason we're doing the 2nd push_image step is because we're hitting this issue, too.

[hylaride]

FYI, this also breaks pushing on build_and_push_image

#9 ERROR: failed to push ********************************************/REMOVED:06a8046: unexpected status from HEAD request to https://********************************************/v2/REMOVED/blobs/sha256:REMOVED: 401 Unauthorized
------
 > exporting to image:
------
ERROR: failed to solve: failed to push ********************************************/REMOVED:06a8046: unexpected status from HEAD request to https://********************************************/v2/REMOVED/blobs/sha256:REMOVED: 401 Unauthorized

[moosilauke18-reify]

I believe it has to do with OIDC not working correctly with amazon-ecr-credential-helper. awslabs/amazon-ecr-credential-helper#581

[marboledacci]

I have been trying to replicate the issue with many configurations, and haven't been able to get it. As a workaround, the version 9.3.0 allows you to specify the parameter use_credentials_helper in the job to use the credentials helper, or the old method with docker login.