# ecr-wait-replication

> ECR wait for replication

Wait until the image(s) just pushed under a mutable branch tag have finished ECR's asynchronous cross-region replication, so a warm-standby region's redeploy can't pull the previous image. Resolves each tag to its digest in the source region and polls the digest's replication status (digest, not tag, is what makes mutable-tag re-pushes safe). Assumes the deploy role via OIDC -- the calling job needs `permissions: id-token: write`.

## Inputs

| Input | Required | Default | Description |
|---|---|---|---|
| `role-arn` | yes | — | DEPLOY_ROLE_ARN -- the deploy IAM role to assume via OIDC. |
| `region` | yes | — | Source region (where the images were pushed -- the app's primary region). |
| `repositories` | yes | — | Repository names to check, space-separated (e.g. "app/be app/opa app/render"). |
| `tag` | yes | — | The branch tag that was just pushed (e.g. branch-main). |
| `destination-region` | yes | — | Region the replicas must reach before this step succeeds. |
| `timeout-minutes` | no | `10` | Give up (and fail) if replication hasn't completed after this long. |

## Usage

```yaml
- uses: actions/checkout@v6
- uses: FSHTech/github-actions/ecr-wait-replication@v1
  with:
    role-arn: ...
    region: ...
    repositories: ...
    tag: ...
    destination-region: ...
```