fix: support packaging on protected branches (#541)

.github/workflows/package.yml

@@ -1,27 +1,49 @@
+name: Update dist files on 
+
 on:
   push:
     branches:
       - master
-
+      - v1-node16
-name: Package
+    paths-ignore:
+      - 'dist/**'
 
 jobs:
-  check:
+  package:
-    name: Package distribution file
+    name: Package dist files
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
-    - name: Checkout
+      - name: Configure AWS credentials
-      uses: actions/checkout@v2
+        uses: aws-actions/configure-aws-credentials@v1-node16
-      with:
+        with:
-        ref: master
+          aws-region: us-west-2
-    - name: Package
+          role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }}
-      run: |
+          role-duration-seconds: 900
-        npm ci
+          role-session-name: SecretsManagerFetch
-        npm test
+      - name: Get bot user token
-        npm run package
+        uses: aws-actions/aws-secretsmanager-get-secrets@v1
-    - name: Commit
+        with:
-      run: |
+          parse-json-secrets: true
-        git config --global user.name "GitHub Actions"
+          secret-ids: |
-        git add dist/
+            OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
-        git commit -m "chore: Update dist" || echo "No changes to commit"
+      - name: Checkout
-        git push origin HEAD:master
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+          token: ${{ env.OSDS_ACCESS_TOKEN }}
+      - name: Package
+        run: |
+          npm ci
+          npm test
+          npm run package
+      - name: Commit
+        run: |
+          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}}"
+          git config --global user.name "GitHub Actions"
+          git add dist/
+          git commit -m "chore: Update dist" || echo "No changes to commit"
+          git push https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git