[CHORE](ci) Point version-check workflow at MCD CodeArtifact - #747
Merged
John McCall (lowlydba) merged 6 commits intoSep 16, 2026
Merged
John McCall (lowlydba) merged 6 commits into
John McCall (lowlydba) merged 6 commits into
Conversation
John McCall (lowlydba)
had a problem deploying
to
staging
September 14, 2026 18:20 — with 
GitHub Actions
Error
GitHub Actions
Error
John McCall (lowlydba)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 14, 2026 18:20
b8f550d to
2428234
Compare
John McCall (lowlydba)
changed the title
🗺️ Schema reference docs preview is live!
Note ♻️ This preview updates automatically with each push to this PR. |
John McCall (lowlydba)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 14, 2026 18:22
2428234 to
7983297
Compare
John McCall (lowlydba)
changed the title
John McCall (lowlydba)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 14, 2026 19:57
7983297 to
89c14df
Compare
John McCall (lowlydba)
marked this pull request as ready for review
September 14, 2026 20:42
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Use a read-only role or otherwise prevent untrusted pull requests from assuming the publish-capable role.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates the reusable package-version check workflow to use MCD CodeArtifact defaults.
Changes:
- Switches the default AWS account to MCD.
- Switches the default IAM role to the MCD CodeArtifact publish role.
- Leaves publishing workflow behavior unchanged.
File summaries
| File | Summary |
|---|---|
.github/workflows/reusable-check-python-package-versions.yaml |
Updates CodeArtifact defaults. The publish-capable role creates a critical security concern for pull-request workflows. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Francisco Jiménez (jjcfrancisco)
previously approved these changes
Sep 15, 2026
Francisco Jiménez (jjcfrancisco)
left a comment
Francisco Jiménez (jjcfrancisco)
left a comment
Member
There was a problem hiding this comment.
Lgtm
John McCall (lowlydba)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 15, 2026 13:48
89c14df to
695d3f2
Compare
John McCall (lowlydba)
requested a review
from Francisco Jiménez (jjcfrancisco)
September 15, 2026 13:57
Seth Fitzsimmons (sethfitz)
previously approved these changes
Sep 15, 2026
Victor Schappert (vcschapp)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 16, 2026 03:43
93e3e94 to
f014a46
Compare
Victor Schappert (vcschapp)
previously approved these changes
Sep 16, 2026
Victor Schappert (vcschapp)
had a problem deploying
to
staging
September 16, 2026 03:44 — with
GitHub Actions
Error
GitHub Actions
Error
Victor Schappert (vcschapp)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 16, 2026 03:45
f014a46 to
8f0db21
Compare
Victor Schappert (vcschapp)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 16, 2026 03:50
8f0db21 to
adede8f
Compare
Collaborator
|
John McCall (@lowlydba) I'm unable to merge b/c of DCO checks failing on two commits, |
Francisco Jiménez (jjcfrancisco)
previously approved these changes
Sep 16, 2026
Francisco Jiménez (jjcfrancisco)
left a comment
Francisco Jiménez (jjcfrancisco)
left a comment
Member
There was a problem hiding this comment.
Thanks for this!
Flips reusable-check-python-package-versions.yaml's aws_account_id/ aws_iam_role_name defaults from legacy CodeArtifact to MCD, reusing codeartifact-pypi-publish-oidc-overturemaps: MCD has no dedicated read-only role and won't get one, but the publish role already grants codeartifact:ReadFromRepository and its OIDC trust policy allows pull_request-context assumption in this repo. Closes #746 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
This reverts commit 0a5f376. Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
This reverts commit eed4eaa. Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
dismissed stale reviews from Francisco Jiménez (jjcfrancisco), Seth Fitzsimmons (sethfitz), and Victor Schappert (vcschapp)
via
September 16, 2026 13:22
4eb246a
John McCall (lowlydba)
force-pushed
the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
from
September 16, 2026 13:22
adede8f to
4eb246a
Compare
Seth Fitzsimmons (sethfitz)
approved these changes
Sep 16, 2026
Francisco Jiménez (jjcfrancisco)
approved these changes
Sep 16, 2026
John McCall (lowlydba)
deleted the
lowlydba-cutover-pypi-consumers-to-codeartifact
branch
September 16, 2026 14:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Part of the OvertureMaps/ops-team#520 MCD CodeArtifact cutover. #745 tracks this repo's full cutover; the legacy publish-step removal there stays blocked until consumers are confirmed off legacy. This PR only lands the version-check workflow's account default flip, which doesn't touch
main-publish.yaml's dual-publish behavior.Change
reusable-check-python-package-versions.yaml'saws_account_id/aws_iam_role_namedefaults move from legacy (505071440022,GithubActions_Schema_CodeArtifact_ReadOnly) to MCD (763944545891,codeartifact-pypi-readonly-oidc-overturemaps).That role is a dedicated read-only role added in OvertureMaps/omf-core-data-opentofu#120 (now merged), scoped to
GetAuthorizationToken/GetRepositoryEndpoint/ReadFromRepositoryonly, closing OvertureMaps/ops-team#521. It replaces an earlier draft of this PR that reused the publish-capable role, which Copilot's review correctly flagged as risky for apull_request-triggered check.Testing
I added a temporary version bump commit on this branch to trigger the modified CI workflow, and it ran successfully: https://github.com/OvertureMaps/schema/actions/runs/34978920990/job/104413801496?pr=747
The commit has been reverted ✅
Fixes #746