aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-04 06:15:07 +09:00
Code Issues Packages Projects Releases Wiki Activity

chore: fix packaging workflow (#805)

Browse Source 
* fix: token permission in package workflow conflicting with unit tests

* change secret arn and role to assume in package workflow

---------

Co-authored-by: Tom Keller <1083460+kellertk@users.noreply.github.com>
This commit is contained in:
Peter Woodworth
2023-08-25 13:35:09 -07:00
committed by GitHub
parent 22617f9706
commit 14b6c355ca
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/package.yml
+3 -2
View File
@@ -6,6 +6,7 @@ on:
- main - main
paths-ignore: paths-ignore:
- 'dist/**' - 'dist/**'
workflow_dispatch:
jobs: jobs:
package: package:
@@ -30,7 +31,7 @@ jobs:
uses: aws-actions/configure-aws-credentials@v3 uses: aws-actions/configure-aws-credentials@v3
with: with:
aws-region: us-west-2 aws-region: us-west-2
role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }} role-to-assume: ${{ secrets.SECRETS_AWS_PACKAGING_ROLE_TO_ASSUME }}
role-duration-seconds: 900 role-duration-seconds: 900
role-session-name: SecretsManagerFetch role-session-name: SecretsManagerFetch
- name: Get bot user token - name: Get bot user token
@@ -38,7 +39,7 @@ jobs:
with: with:
parse-json-secrets: true parse-json-secrets: true
secret-ids: | secret-ids: |
OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
- name: Commit - name: Commit
run: | run: |
echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}" echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
test/index.test.ts
+2
View File
@@ -508,6 +508,7 @@ describe('Configure AWS Credentials', () => {
}); });
test('GH OIDC check fails if token is not set', async () => { test('GH OIDC check fails if token is not set', async () => {
process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] = undefined;
process.env['GITHUB_ACTIONS'] = 'true'; process.env['GITHUB_ACTIONS'] = 'true';
jest.spyOn(core, 'getInput').mockImplementation( jest.spyOn(core, 'getInput').mockImplementation(
mockGetInput({ mockGetInput({
@@ -528,6 +529,7 @@ describe('Configure AWS Credentials', () => {
}); });
test('Assume role with existing credentials if nothing else set', async () => { test('Assume role with existing credentials if nothing else set', async () => {
process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] = undefined;
process.env['AWS_ACCESS_KEY_ID'] = FAKE_ACCESS_KEY_ID; process.env['AWS_ACCESS_KEY_ID'] = FAKE_ACCESS_KEY_ID;
process.env['AWS_SECRET_ACCESS_KEY'] = FAKE_SECRET_ACCESS_KEY; process.env['AWS_SECRET_ACCESS_KEY'] = FAKE_SECRET_ACCESS_KEY;
jest.spyOn(core, 'getInput').mockImplementation( jest.spyOn(core, 'getInput').mockImplementation(