Create AWS role session name action

[sarasvoss]

Summary

• add the versioned create-aws-role-session-name composite action
• build role session names from the operation, environment, run ID, and actor
• replace invalid bytes deterministically, enforce AWS's 64-character limit, and expose the sanitized name
• document the action contract, immutable-SHA usage, and initial 1.0.0 release
• clarify that narrowly scoped, versioned utility composites under .github/actions are supported while legacy root-level composites remain deprecated

Why

AWS role session names must use a restricted character set and cannot exceed 64 characters. Actor names such as renovate[bot] therefore need deterministic sanitization before they are passed to credential configuration.

Impact

Consumers can use one versioned utility action for safe role-session-name construction without duplicating shell logic. This is phase one of the credential orchestration work; no AWS credentials are configured by this PR.

Validation

• npm test -- --runInBand — 55 tests passed
• npm run lint:check
• npm run format:check
• component version-label validation for version:actions/create-aws-role-session-name/1.0.0
• YAML parsing and composite action contract check
• targeted coverage for output format, bot names, valid characters, whitespace/slashes/brackets/shell metacharacters, multibyte input, truncation, and AWS-compatible output
• GitHub Actions Semgrep scan — zero findings

Known repository-level check

Internal CI currently stops during npm audit on dependency advisories present on the default branch and unrelated to this action-only diff.

[github-actions]

Tags

The following tags will be created on main after merge

🏷️ actions/create-aws-role-session-name/1.0.0

[Copilot]

Pull request overview

Adds a new versioned utility composite action under .github/actions to deterministically construct AWS-compatible role session names from workflow context, and updates repository documentation to clarify support for narrowly scoped versioned composites while legacy root-level composites remain deprecated.

Changes:

• Introduces sanitize-aws-session-name composite action that builds and sanitizes role session names (character allowlist + deterministic replacement + 64-char truncation) and exposes the sanitized output.
• Adds action-specific documentation and changelog for an initial 1.0.0 component release.
• Updates root README guidance around deprecations and preferred reusable-workflow vs utility-composite usage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Clarifies legacy composite action deprecation and documents when versioned utility composites under .github/actions are acceptable.
.github/actions/sanitize-aws-session-name/README.md	Documents the action contract, sanitization rules, outputs, and immutable-SHA pinning guidance.
.github/actions/sanitize-aws-session-name/CHANGELOG.md	Adds initial 1.0.0 changelog entry for the new action.
.github/actions/sanitize-aws-session-name/action.yml	Implements the composite action that builds and sanitizes the AWS role session name and sets the name output.
.github/actions/sanitize-aws-session-name/action.unit.test.js	Adds unit tests validating sanitization behavior, truncation, and safety against shell metacharacters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Semgrep Security Scan Passed

🎉 No security issues found!

View run
_{🤖 Powered by Semgrep + reviewdog}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/create-aws-role-session-name/action.unit.test.js:20

• extractRunScript() relies on a regex that captures from the first run: | all the way to the end of the file and then strips exactly 8 leading spaces line-by-line. This is brittle: if the action.yml later adds another step or any content after the run block, the test will start executing YAML as bash (and may fail in a confusing way). Consider matching only the indented run-block lines and stripping indentation via a multiline replace.

  const actionDefinition = fs.readFileSync(actionPath, 'utf8');
  const runBlock = actionDefinition.match(/      run: \|\n([\s\S]+)$/);

  if (!runBlock) {
    throw new Error('Unable to find the action run script');
  }

  return runBlock[1]
    .split('\n')
    .map(line => line.replace(/^ {8}/, ''))
    .join('\n');

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/create-aws-role-session-name/action.unit.test.js:10

• extractRunScript() currently assumes the run: | block is the last content in action.yml (the regex captures to end-of-file). If any YAML keys/steps are added after the run block later, the extracted script will include extra YAML and tests will fail. Use an indentation-bounded, multiline match so only the run block’s indented lines are captured.

  const runBlock = actionDefinition.match(/      run: \|\n([\s\S]+)$/);