Bash implementation of Docker credential helper for AWS ECR (without any storage)

docker-credential-shipmonk-ecr-login

#!/usr/bin/env bash
set -euo pipefail

# Bash implementation of Docker credential helper for AWS ECR (without any storage)
# https://docs.docker.com/reference/cli/docker/login/#credential-helper-protocol

if [ "$1" == "get" ]; then
    SERVER_URL=$(cat)

    # Extract region from URL format: *.dkr.ecr.REGION.amazonaws.com
    REGION="${SERVER_URL#*.dkr.ecr.}"
    REGION="${REGION%.amazonaws.com}"

    if [[ ! "$REGION" =~ ^[a-z]{2}-[a-z]+-[0-9]+$ ]]; then
        echo "Error: Could not extract valid region from $SERVER_URL" >&2
        exit 1
    fi

    aws sts get-caller-identity >/dev/null 2>&1 || aws sso login --no-browser --use-device-code >&2
    SECRET=$(aws ecr get-login-password --region "$REGION")
    jq -n --arg username "AWS" --arg secret "$SECRET" '{Username: $username, Secret: $secret}'
fi