feat(configure-aws-credentials): wrap the official AWS action - #269
Merged
Merged
Conversation
joakimen
force-pushed
the
feat/configure-aws-credentials-wrap-aws-action
branch
from
September 15, 2026 09:46
df84fec to
01b6ca1
Compare
joakimen
force-pushed
the
feat/configure-aws-credentials-wrap-aws-action
branch
from
September 15, 2026 10:27
01b6ca1 to
6da4239
Compare
joakimen
force-pushed
the
feat/configure-aws-credentials-wrap-aws-action
branch
from
September 15, 2026 10:44
6da4239 to
8b817fd
Compare
Replaces a hand-rolled OIDC exchange, retry loop and STS call with aws-actions/configure-aws-credentials, pinned by SHA. AWS_REGION is exported by a step of its own, because the wrapped action exports it only when it also exports credentials, which is off by default here. A test asserts the credentials themselves stay out of the job environment, which is what all but three of the repositories using this rely on. The two inputs without defaults are still checked, so a missing one says which rather than composing a role ARN that fails as an opaque STS error. A failure takes a minute or two to surface rather than fifteen seconds: the wrapped action retries twelve times with backoff, on any error rather than only a transient one. Inputs, outputs and keeping credentials out of the job environment are unchanged.
joakimen
force-pushed
the
feat/configure-aws-credentials-wrap-aws-action
branch
from
September 15, 2026 13:02
8b817fd to
43c159a
Compare
|
🎉 This PR is included in version 1.19.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces a hand-rolled OIDC exchange, retry loop and STS call with
aws-actions/configure-aws-credentials, pinned by SHA. Inputs, outputs and the default of keeping credentials out of the job environment are unchanged.AWS_REGIONis exported by a step of its own: the wrapped action exports the region only when it also exports credentials, so relying on it would have stopped the region reaching later steps in every repository that takes the default.Behaviour
A failure takes longer to surface — twelve retries with backoff rather than three, five seconds apart, and on any error rather than only a transient one.
For the three repositories that ask for credentials in the environment, the wrapped action adds a post-job step that unsets them, and also sets
AWS_DEFAULT_REGION.