fix: support packaging on protected branches (#541)

.github/workflows/package.yml

@@ -1,19 +1,40 @@
+name: Update dist files on 
+
 on:
   push:
     branches:
       - master
-
+      - v1-node16
-name: Package
+    paths-ignore:
+      - 'dist/**'
 
 jobs:
-  check:
+  package:
-    name: Package distribution file
+    name: Package dist files
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
-    - name: Checkout
+      - name: Configure AWS credentials
-      uses: actions/checkout@v2
+        uses: aws-actions/configure-aws-credentials@v1-node16
         with:
-        ref: master
+          aws-region: us-west-2
+          role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }}
+          role-duration-seconds: 900
+          role-session-name: SecretsManagerFetch
+      - name: Get bot user token
+        uses: aws-actions/aws-secretsmanager-get-secrets@v1
+        with:
+          parse-json-secrets: true
+          secret-ids: |
+            OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+          token: ${{ env.OSDS_ACCESS_TOKEN }}
       - name: Package
         run: |
           npm ci
@@ -21,7 +42,8 @@ jobs:
           npm run package
       - name: Commit
         run: |
+          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}}"
           git config --global user.name "GitHub Actions"
           git add dist/
           git commit -m "chore: Update dist" || echo "No changes to commit"
-        git push origin HEAD:master
+          git push https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git