chore: unstage devel changes (#1786)

* Revert "chore: Update dist" This reverts commit e8614cfbf0. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1045.0 to 3.1049.0 (#1782)" This reverts commit 4684f47f89. * Revert "chore: Update dist" This reverts commit 48b8685c96. * Revert "chore(deps-dev): bump @smithy/property-provider from 4.3.1 to 4.3.3 (#1783)" This reverts commit fe6ad3af19. * Revert "chore: Update dist" This reverts commit 2520c5e921. * Revert "chore(deps-dev): bump @aws-sdk/credential-provider-env (#1784)" This reverts commit bc1093db1d. * Revert "chore(deps-dev): bump @types/node from 25.7.0 to 25.9.0 (#1785)" This reverts commit ffde832a1d. * Revert "chore: Update dist" This reverts commit 707acd96f6. * Revert "chore(deps): bump @smithy/node-http-handler from 4.7.1 to 4.7.3 (#1781)" This reverts commit a7c33ae483. * Revert "chore: update README for additional claim support (#1779)" This reverts commit 713aaabfec. * Revert "chore: Update dist" This reverts commit e6e8eba750. * Revert "fix: skip credential check on output-env-credentials: false (#1778)" This reverts commit 58e7c47adf. * Revert "chore: document forgejo compatibility (#1776)" This reverts commit f35a7d7d7e. * Revert "chore: Update dist" This reverts commit 3884f59ecd. * Revert "feat: add additional session tags by default (#1775)" This reverts commit e0ba768507. * Revert "chore: Update dist" This reverts commit 6795889618. * Revert "feat: expose run id in STS client user-agent (#1774)" This reverts commit 29d1be3027. * Revert "chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 (#1773)" This reverts commit ef734cca81. * Revert "chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#1772)" This reverts commit 7521c55910. * Revert "chore: Update dist" This reverts commit c0e2737f14. * Revert "chore(deps): bump @smithy/node-http-handler from 4.6.1 to 4.7.1 (#1770)" This reverts commit dbd503f368. * Revert "chore: Update dist" This reverts commit 18a236fbd1. * Revert "chore(deps-dev): bump @smithy/property-provider from 4.2.14 to 4.3.1 (#1771)" This reverts commit 1ab31502aa. * Revert "chore(deps-dev): bump @vitest/coverage-v8 from 4.1.5 to 4.1.6 (#1768)" This reverts commit 1fb495c4b2. * Revert "chore: Update dist" This reverts commit 1e8fec8ea1. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1044.0 to 3.1045.0 (#1767)" This reverts commit a388f23f7d. * Revert "chore: update documentation for environment workflows (#1766)" This reverts commit 3f7e1b63d7. * Revert "feat: add regex validation to role-session-name (#1765)" This reverts commit e35449909c. * Revert "chore: Update dist" This reverts commit 958a80fc34. * Revert "feat: add more retry logic and better logging (#1764)" This reverts commit 540d0c13ae. * Revert "chore: automate README version bumping (#1763)" This reverts commit 07ada0fe07. * Revert "chore: Update dist" This reverts commit f8d4eb68a9. * Revert "feat: support custom STS endpoints (#1762)" This reverts commit 8d52d05d7a. * Revert "chore: Update dist" This reverts commit 681892c11b. * Revert "chore: configure codeql to ignore generated code (#1760)" This reverts commit dc2353e57a. * Revert "feat: Allow custom session tags to be passed when assuming a role (#1759)" This reverts commit 61f50f630f. * Revert "chore: automatic major version tagging (#1565)" This reverts commit c36525a567. * Revert "chore: bump unit test node version (#1758)" This reverts commit 39d1702721. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1043.0 to 3.1044.0 (#1754)" This reverts commit 4cfda40a13. * Revert "chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 (#1756)" This reverts commit 8856e12f3a. * Revert "chore(deps): bump @actions/core from 2.0.3 to 3.0.1 (#1746)" This reverts commit 64d8e82527. * Revert "chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748)" This reverts commit 78f374f6d1.
2026-09-04 06:15:07 +09:00 · 2026-05-25 12:19:31 -07:00
parent e8614cfbf0
commit 3cc0e19239
20 changed files with 24501 additions and 21311 deletions
@@ -19,7 +19,6 @@ import { writeProfileFiles } from './profileManager';
 const DEFAULT_ROLE_DURATION = 3600; // One hour (seconds)
 const ROLE_SESSION_NAME = 'GitHubActions';
 const REGION_REGEX = /^[a-z0-9-]+$/g;
-const ROLE_SESSION_NAME_REGEX = /^[\w+=,.@-]*$/;

 export async function run() {
  try {
@@ -44,7 +43,6 @@ export async function run() {
    const roleSkipSessionTagging = getBooleanInput('role-skip-session-tagging', { required: false });
    const transitiveTagKeys = core.getMultilineInput('transitive-tag-keys', { required: false });
    const proxyServer = core.getInput('http-proxy', { required: false }) || process.env.HTTP_PROXY;
-    const customTags = core.getInput('custom-tags', { required: false });
    const inlineSessionPolicy = core.getInput('inline-session-policy', { required: false });
    const managedSessionPolicies = core.getMultilineInput('managed-session-policies', { required: false }).map((p) => {
      return { arn: p };
@@ -65,7 +63,6 @@ export async function run() {
      .map((s) => s.trim());
    const forceSkipOidc = getBooleanInput('force-skip-oidc', { required: false });
    const noProxy = core.getInput('no-proxy', { required: false });
-    const stsEndpoint = core.getInput('sts-endpoint', { required: false });
    const globalTimeout = Number.parseInt(core.getInput('action-timeout-s', { required: false })) || 0;

    let timeoutId: NodeJS.Timeout | undefined;
@@ -91,9 +88,6 @@ export async function run() {
      maxRetries = 1;
    }

-    const withRetry = <T>(fn: () => Promise<T>, label: string): Promise<T> =>
-      retryAndBackoff(fn, !disableRetry, maxRetries, 0, 50, label);
-
    // Logic to decide whether to attempt to use OIDC or not
    const useGitHubOIDCProvider = () => {
      if (forceSkipOidc) return false;
@@ -130,33 +124,15 @@ export async function run() {
      throw new Error(`Region is not valid: ${region}`);
    }

-    if (roleSessionName.length < 2 || roleSessionName.length > 64) {
-      throw new Error(
-        `Role session name must be between 2 and 64 characters, got ${roleSessionName.length}: '${roleSessionName}'`,
-      );
-    }
-    if (!roleSessionName.match(ROLE_SESSION_NAME_REGEX)) {
-      throw new Error(
-        `Role session name is not valid: '${roleSessionName}'. Must satisfy regular expression pattern: [\\w+=,.@-]*`,
-      );
-    }
-
    exportRegion(region, outputEnvCredentials);

    // Instantiate credentials client
-    const clientProps: {
-      region: string;
-      proxyServer?: string;
-      noProxy?: string;
-      stsEndpoint?: string;
-      roleChaining: boolean;
-    } = {
+    const clientProps: { region: string; proxyServer?: string; noProxy?: string; roleChaining: boolean } = {
      region,
      roleChaining,
    };
    if (proxyServer) clientProps.proxyServer = proxyServer;
    if (noProxy) clientProps.noProxy = noProxy;
-    if (stsEndpoint) clientProps.stsEndpoint = stsEndpoint;
    const credentialsClient = new CredentialsClient(clientProps);
    let sourceAccountId: string;
    let webIdentityToken: string;
@@ -176,9 +152,13 @@ export async function run() {
    // Else, export credentials provided as input
    if (useGitHubOIDCProvider()) {
      try {
-        webIdentityToken = await withRetry(async () => {
-          return core.getIDToken(audience);
-        }, 'getIDToken');
+        webIdentityToken = await retryAndBackoff(
+          async () => {
+            return core.getIDToken(audience);
+          },
+          !disableRetry,
+          maxRetries,
+        );
      } catch (error) {
        throw new Error(`getIDToken call failed: ${errorMessage(error)}`);
      }
@@ -199,77 +179,59 @@ export async function run() {
      }
    } else if (!webIdentityTokenFile && !roleChaining) {
      // Proceed only if credentials can be picked up
-      await withRetry(
-        () => credentialsClient.validateCredentials(undefined, roleChaining, expectedAccountIds),
-        'validateCredentials',
-      );
-      sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+      await credentialsClient.validateCredentials(undefined, roleChaining, expectedAccountIds);
+      sourceAccountId = await exportAccountId(credentialsClient, maskAccountId);
    }

    if (AccessKeyId || roleChaining) {
      // Validate that the SDK can actually pick up credentials.
      // This validates cases where this action is using existing environment credentials,
      // and cases where the user intended to provide input credentials but the secrets inputs resolved to empty strings.
-      // Skip when output-env-credentials is false: input IAM keys were not written to env, so
-      // the default chain would resolve to ambient runner credentials and the access-key check
-      // would spuriously fail (see #1554).
-      if (outputEnvCredentials) {
-        await withRetry(
-          () => credentialsClient.validateCredentials(AccessKeyId, roleChaining, expectedAccountIds),
-          'validateCredentials',
-        );
-        sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
-      }
+      await credentialsClient.validateCredentials(AccessKeyId, roleChaining, expectedAccountIds);
+      sourceAccountId = await exportAccountId(credentialsClient, maskAccountId);
    }
-    if (customTags && (useGitHubOIDCProvider() || webIdentityTokenFile)) {
-      core.warning(
-        "'custom-tags' is set but will be ignored because session tags cannot be applied when using OIDC or web identity token authentication. " +
-          'Tags are controlled by the identity provider token claims in these authentication flows.',
-      );
-    }
-
    // Get role credentials if configured to do so
    if (roleToAssume) {
      let roleCredentials: AssumeRoleCommandOutput;
      do {
-        roleCredentials = await withRetry(async () => {
-          return assumeRole({
-            credentialsClient,
-            sourceAccountId,
-            roleToAssume,
-            roleExternalId,
-            roleDuration,
-            roleSessionName,
-            roleSkipSessionTagging,
-            transitiveTagKeys,
-            webIdentityTokenFile,
-            webIdentityToken,
-            inlineSessionPolicy,
-            managedSessionPolicies,
-            customTags,
-          });
-        }, 'AssumeRole');
+        roleCredentials = await retryAndBackoff(
+          async () => {
+            return assumeRole({
+              credentialsClient,
+              sourceAccountId,
+              roleToAssume,
+              roleExternalId,
+              roleDuration,
+              roleSessionName,
+              roleSkipSessionTagging,
+              transitiveTagKeys,
+              webIdentityTokenFile,
+              webIdentityToken,
+              inlineSessionPolicy,
+              managedSessionPolicies,
+            });
+          },
+          !disableRetry,
+          maxRetries,
+        );
      } while (specialCharacterWorkaround && !verifyKeys(roleCredentials.Credentials));
      core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser?.AssumedRoleId}`);
      exportCredentials(roleCredentials.Credentials, outputCredentials, outputEnvCredentials);
-      // Validate that the SDK can pick up the assumed-role credentials from the environment.
-      // Skip when output-env-credentials is false: the credentials were never written to env,
-      // so the default credential provider chain would resolve to ambient runner credentials
-      // (e.g. an EC2 instance profile) and the access-key-id check would spuriously fail.
-      // Skip when using a profile: validation runs after the profile file is written below.
-      if ((!process.env.GITHUB_ACTIONS || AccessKeyId) && !awsProfile && outputEnvCredentials) {
-        await withRetry(
-          () =>
-            credentialsClient.validateCredentials(
-              roleCredentials.Credentials?.AccessKeyId,
-              roleChaining,
-              expectedAccountIds,
-            ),
-          'validateCredentials',
+      // We need to validate the credentials in 2 of our use-cases
+      // First: self-hosted runners. If the GITHUB_ACTIONS environment variable
+      //  is set to `true` then we are NOT in a self-hosted runner.
+      // Second: Customer provided credentials manually (IAM User keys stored in GH Secrets)
+      // If we are using a profile, don't validate credentials yet (since they most likely won't be in the environment).
+      // Wait until after creds are written to the profile file to try validation.
+      if ((!process.env.GITHUB_ACTIONS || AccessKeyId) && !awsProfile) {
+        await credentialsClient.validateCredentials(
+          roleCredentials.Credentials?.AccessKeyId,
+          roleChaining,
+          expectedAccountIds,
        );
      }
      if (outputEnvCredentials) {
-        await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+        await exportAccountId(credentialsClient, maskAccountId);
      }

      // Write profile files if profile mode is enabled
@@ -282,14 +244,10 @@ export async function run() {
        // We then validate the credentials to make sure they work.
        if (AccessKeyId || !process.env.GITHUB_ACTIONS) {
          writeProfileFiles(awsProfile, roleCredentials.Credentials, region, true);
-          await withRetry(
-            () =>
-              credentialsClient.validateCredentials(
-                roleCredentials.Credentials?.AccessKeyId,
-                roleChaining,
-                expectedAccountIds,
-              ),
-            'validateCredentials',
+          await credentialsClient.validateCredentials(
+            roleCredentials.Credentials.AccessKeyId,
+            roleChaining,
+            expectedAccountIds,
          );
        } else {
          writeProfileFiles(awsProfile, roleCredentials.Credentials, region, overwriteAwsProfile);