ci: build and push grid-wallet-prod image to ECR

[mariano-macri]

Stacked on #746 (which makes the image buildable at all).

Builds components/grid-wallet-prod and pushes it to the ECR repo vended by tooling-infra (terraform/apps/grid-wallet-prod), so the app can be deployed to the internal tooling EKS cluster behind Okta.

What it does

On pushes to main touching components/grid-wallet-prod/**: assume github-actions-grid-wallet-prod via GitHub OIDC, build linux/arm64, push an immutable sha-<gitsha> tag.

Three things worth reviewing

Landing order is mandatory. The path filter includes the workflow's own file, so merging this before the component stack reaches main triggers a run against a main with no components/grid-wallet-prod/ directory, and the build fails on a missing working directory. Land the component stack first, this second.

linux/arm64 because the tooling-prod cluster is Graviton (m8g). No other workflow in this repo uses an ARM label yet — if the first run sits in queued, GitHub-hosted ARM runners aren't enabled for the org and the fallback is setup-qemu + setup-buildx on ubuntu-latest (noted inline). ARC runners are not an option here: they have no Docker daemon.

The sandbox flag is a build arg, not config. NEXT_PUBLIC_* is inlined by Next at build time, so --build-arg NEXT_PUBLIC_GRID_SANDBOX=true is written literally in the workflow and has no default in the Dockerfile. A future production image would be a separate workflow against a separate ECR repo and cannot inherit the sandbox affordance by accident.

Idempotency

The ECR repo is IMMUTABLE-tagged, so re-pushing an existing tag is a hard failure. The build is guarded by a describe-images check that distinguishes "tag absent" from "the call failed" — a bare if aws ... >/dev/null 2>&1 is exempt from set -e and would treat an IAM error as a missing image, then die on the immutable push. Only ImageNotFoundException means "go build"; anything else fails loudly.

No workflow_dispatch: the IAM trust policy pins the sub claim to refs/heads/main, so a dispatch from any other ref could not authenticate.

Depends on

tooling-infra PR (ECR repo + github-actions-grid-wallet-prod role) must be applied before this runs, or the first push has nothing to authenticate against.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored		Jul 26, 2026 5:08pm
grid-wallet-demo	Ignored		Jul 26, 2026 5:08pm

[greptile-apps]

Greptile Summary

Adds a GitHub Actions workflow that builds the Grid Wallet production component for ARM64 and publishes an immutable commit-tagged image to ECR.

• Runs on pushes to main affecting the component or workflow.
• Authenticates to AWS through GitHub OIDC.
• Skips builds when the commit image already exists and distinguishes missing images from AWS command failures.

Confidence Score: 4/5

The PR is not yet safe to merge because the privileged publishing job still executes actions through mutable references.

The previously reported supply-chain path remains at HEAD: code selected by mutable action tags executes with OIDC permission and participates in assuming the ECR-publishing role.

Files Needing Attention: .github/workflows/grid-wallet-prod-image.yml

Important Files Changed

Filename	Overview
.github/workflows/grid-wallet-prod-image.yml	Adds the ARM64 ECR image build-and-publish workflow with immutable-tag idempotency handling.

_{Reviews (2): Last reviewed commit: "ci: don't treat a failed describe-images..." | Re-trigger Greptile}

[greptile-apps]

Mutable privileged action reference

This image-publishing job references executable actions by mutable major-version tags while granting OIDC or inherited AWS credential access. Pinning these actions to full commit SHAs prevents an upstream tag change from altering the code that can assume the publishing role or modify and publish the image.

How this was verified: The referenced actions run in a job with id-token: write, and the workflow subsequently assumes the ECR-publishing role and pushes the checked-out workspace.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/grid-wallet-prod-image.yml
Line: 28

Comment:
**Mutable privileged action reference**

This image-publishing job references executable actions by mutable major-version tags while granting OIDC or inherited AWS credential access. Pinning these actions to full commit SHAs prevents an upstream tag change from altering the code that can assume the publishing role or modify and publish the image.

**How this was verified:** The referenced actions run in a job with `id-token: write`, and the workflow subsequently assumes the ECR-publishing role and pushes the checked-out workspace.

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[mariano-macri]

@greptileai review

No new commits since your last review — re-triggering for a fresh pass now that the sibling PRs have changed.

On the mutable action tags you flagged: keeping @v4/@v2 deliberately. All three are first-party (actions/checkout from GitHub; configure-aws-credentials and amazon-ecr-login from AWS), and this repo has no Dependabot config — so SHA pins would have no update path, freeze, and stop receiving upstream security fixes. That's a worse posture than tracking the major tag, not a better one. Pinning is right once there's a mechanism keeping pins current; that's a repo-wide change worth doing deliberately rather than inside a CI-wiring PR.