Add AWS OIDC configuration action - #113
Merged
Merged
Conversation
sarasvoss
added
documentation
sarasvoss
added
the
version:actions/configure-aws-oidc/1.0.0
TagsThe following tags will be created on main after merge 🏷️ |
There was a problem hiding this comment.
Pull request overview
Adds a new, versioned composite GitHub Action (configure-aws-oidc) that standardizes AWS role session naming, role/region resolution via get-role-arn, and credential configuration via GitHub OIDC, with accompanying documentation and release notes.
Changes:
- Introduces
.github/actions/configure-aws-oidccomposite action to orchestrate session-name creation, role resolution, and credential configuration. - Documents required permissions, workspace side effects (resolver checkout), and recommended checkout ordering for consumers.
- Adds an initial
1.0.0changelog entry describing the new behavior and outputs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/actions/configure-aws-oidc/action.yml | New composite action wiring session-name creation + role resolution + configure-aws-credentials, with pinned SHAs. |
| .github/actions/configure-aws-oidc/README.md | Usage docs, permissions, inputs/outputs, and guidance around workspace side effects and checkout ordering. |
| .github/actions/configure-aws-oidc/CHANGELOG.md | Initial 1.0.0 release notes for the new composite action. |
Suppressed comments (1)
.github/actions/configure-aws-oidc/README.md:44
- The outputs table is formatted with an extra leading pipe (
|| ...), which renders as an empty first column in Markdown. Remove the extra|so the table renders correctly.
| Name | Description |
| ------------------- | -------------------------------- |
| `role-arn` | Resolved AWS role ARN. |
| `region` | Resolved AWS region. |
| `role-session-name` | Sanitized AWS role session name. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+27
to
+35
| | Name | Required | Description | | ||
| | ----------------------- | -------- | ---------------------------------------------------------------------- | | ||
| | `domain` | Yes | Domain forwarded to the AWS role resolver. | | ||
| | `environment` | Yes | Environment forwarded to the resolver and role-session-name creator. | | ||
| | `action` | Yes | Operation label included in the role session name. | | ||
| | `run-id` | Yes | GitHub Actions run ID included in the role session name. | | ||
| | `actor` | Yes | Triggering GitHub actor included in the role session name. | | ||
| | `ORG_READ_ONLY_SSH_KEY` | Yes | Private SSH key required by `OpenSesame/gha-oidc-access/get-role-arn`. | | ||
|
|
Comment on lines
+69
to
+72
| # Required when later steps need files from the consumer repository. | ||
| - name: Checkout consumer repository | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
configure-aws-oidccomposite action1.0.0release contractWhy
Consumers currently repeat the same credential-orchestration steps and must keep their wiring, session naming, and dependency pins consistent. This action provides one supported same-job integration point while preserving the existing resolver behavior.
Consumer impact
Consumers can replace the same-job role-resolution and credential-configuration sequence with this action. Because the role resolver checks out its own repository, workflows that need consumer source must run checkout after this action.
Validation
npm run checkSemgrep completed successfully and reported one pre-existing mutable action-tag finding in
.github/actions/upsert-pr-comment/action.yml; this change pins all of its action dependencies to immutable commit SHAs.