* fix: enforce allowed-account-ids when the list contains empty entries
An empty first element previously short-circuited the allowed account
check. Empty entries are now filtered out and validation applies
whenever any non-empty entry exists.
* fix: enforce allowed-account-ids on the use-existing-credentials path
The early return for valid pre-existing credentials skipped the
allowed-account-ids check, now included.
* fix: reject newlines in names and values when writing profile files
If the profile file writing was enabled, we emitted newlines into the
file verbatim, permitting injecting arbitrary profiles into the file.
Writing now fails instead.
* fix: honor configured STS endpoint for "ambient" credentials
Ambient credential resolution built a bare STS client, so a web-identity
token found by the SDK default chain (e.g. AWS_WEB_IDENTITY_TOKEN_FILE on
a self-hosted runner) was exchanged with public STS instead of any
operator-configured sts-endpoint. Resolution now passes the configured
region, endpoint, and proxy handler to the default provider chain.
* fix: mask proxy URL credentials in job logs
Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment
variables was never registered as a secret, so error messages carrying
the proxy URL printed the credentials unmasked in the job log.
* fix: omit account IDs from the allowed-account-ids failure message
The mismatch error is thrown before exportAccountId registers the
account-id mask, so setFailed wrote the raw account ID (and the
configured allow-list) into a public annotation. (C4)
* chore: remove outdated examples
All of the examples were out of date and we do not have a mechanism for
keeping them up to date. Removed the examples.
Noticed a typo where "oidc" was mistakenly written as "odic". This typo was present in both the documentation and a certain file name.
Co-authored-by: Tom Keller <1083460+kellertk@users.noreply.github.com>
Tom Keller