4ab3589ed2
chore: replay 6.2 devel changes onto main ( #1807 )
...
* chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748 )
* chore(deps-dev): bump vitest from 3.2.4 to 4.1.5
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ) from 3.2.4 to 4.1.5.
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest )
---
updated-dependencies:
- dependency-name: vitest
dependency-version: 4.1.5
dependency-type: direct:development
update-type: version-update:semver-major
...
* chore(deps-dev): update @vitest/coverage-v8
Bump @vitest/coverage-v8 to ^4.1.5 to match peer dependency, and move
vi.mock('node:fs') calls to the top level of test files to reflect
actual hoisting semantics required by vitest 4.x.
---------
(cherry picked from commit 78f374f6d1#1746 )
* chore(deps): bump @actions/core from 2.0.3 to 3.0.1
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core ) from 2.0.3 to 3.0.1.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md )
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core )
---
updated-dependencies:
- dependency-name: "@actions/core"
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
* chore: update test mocks for @actions/core ESM
@actions/core v3 ships as an ESM module with non-configurable exports,
breaking vi.spyOn(). Switch to vi.mock('@actions/core') which
intercepts at the module loader level.
---------
(cherry picked from commit 64d8e82527#1754 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1043.0 to 3.1044.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1044.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1042.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
(cherry picked from commit 4cfda40a13#1758 )
(cherry picked from commit 39d1702721#1565 )
* Update release-please.yml to auto-update version tag
* chore: configure release-please auto floating tag
---------
(cherry picked from commit c36525a567#1759 )
* Add possibility to input custom session tags
* Use json for input to custom-tags, add documentation for custom-tags
* Add more examples
* Simplify example to avoid parse error
* Add input validation for custom tags
* Fix unit tests for custom-tags
* Add debugging message
* Skip failing test for now
* Build package
* Remove some unused validation for custom tags
* feat: add validation for custom session tags
Harden the custom-tags feature against misuse and
misconfiguration:
- Validate input is a JSON object (reject arrays, primitives, null)
- Enforce STS tag constraints: key length (128), value length (256),
allowed characters
- Reject nested object/array values that would silently stringify to
'[object Object]'
- Block overriding default session tags (GitHub, Repository,
Workflow, etc.)
- Enforce 50-tag session limit
- Warn when custom-tags used with OIDC or web identity
- Fix missing await on helpers test assertion
- Remove unused CUSTOM_TAGS_JSON_INPUTS fixture
- Normalize test mocking to vi.mocked() pattern
---------
(cherry picked from commit 61f50f630f#1760 )
(cherry picked from commit dc2353e57a#1762 )
Closes #1067 . This is a advanced option
and is not needed for most deployments.
(cherry picked from commit 8d52d05d7a#1763 )
Closes #1420 .
(cherry picked from commit 07ada0fe07#1764 )
Wraps exportAccountId and validateCredentials calls in retryAndBackoff.
Closes #1681 . Adds a label parameter to retryAndBackoff for better
info-level log messages.
(cherry picked from commit 540d0c13ae#1765 )
Previously invalid role session names would get errors from the STS
API instead of this action rejecting them, causing unnecessary retries.
Now we check them and fail early.
Closes #1656 . That FR recommended that we sanitize the name before
sending to STS, but instead we error to not silently change the user's
selected session name (avoiding the potential security sharp edge)
(cherry picked from commit e35449909c#1766 )
Closes #1238 .
(cherry picked from commit 3f7e1b63d7#1767 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1044.0 to 3.1045.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1045.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
(cherry picked from commit a388f23f7d#1768 )
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8 ) from 4.1.5 to 4.1.6.
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/coverage-v8 )
---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.1.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
(cherry picked from commit 1fb495c4b2#1771 )
Bumps [@smithy/property-provider](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/property-provider ) from 4.2.14 to 4.3.1.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/property-provider/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/property-provider@4.3.1/packages/property-provider )
---
updated-dependencies:
- dependency-name: "@smithy/property-provider"
dependency-version: 4.3.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
(cherry picked from commit 1ab31502aa#1770 )
Bumps [@smithy/node-http-handler](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/node-http-handler ) from 4.6.1 to 4.7.1.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/node-http-handler@4.7.1/packages/node-http-handler )
---
updated-dependencies:
- dependency-name: "@smithy/node-http-handler"
dependency-version: 4.7.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
(cherry picked from commit dbd503f368#1772 )
Bumps [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ) from 2.4.14 to 2.4.15.
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome )
---
updated-dependencies:
- dependency-name: "@biomejs/biome"
dependency-version: 2.4.15
dependency-type: direct:development
update-type: version-update:semver-patch
...
(cherry picked from commit 7521c55910#1773 )
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.6.0 to 25.7.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.7.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
(cherry picked from commit ef734cca81#1774 )
* feat: expose run id in STS client user-agent
Closes #483 .
This commit modifies the user-agent string so that it includes the
GITHUB_RUN_ID and the GITHUB_RUN_ATTEMPT, in the format typically used
by the SDK. User agent strings are logged to CloudTrail, allowing users
to correlate CloudTrail events with GHA runs. We took this approach
instead of logging the ACCESS_KEY_ID as suggested in the issue to avoid
logging sensitive information.
* feat: add github_action to ua string
(cherry picked from commit 29d1be3027#1775 )
Closes #390 .
Note that 50 session tags are the AWS default, and this commit changes
our default set from 7 tags to 15 tags. This commit includes logic to
split the tags into "required" vs "overridable". Required tags are this
action's previous defaults and could never be overridden. Overridable
tags are the new set and can be overridden by custom-tags. The action
will not add tags if the addition plus the required plus the user's
custom tags exceed the AWS limit of 50 total tags. This ensures
backwards compat for the tag additions.
(cherry picked from commit e0ba768507#1776 )
* chore: document forgejo compatibility
* chore: linting fixes
(cherry picked from commit f35a7d7d7e#1778 )
Closes #1554 .
(cherry picked from commit 58e7c47adf#1779 )
* chore: update README for additional claim support
* chore: lint fix (whitespace)
(cherry picked from commit 713aaabfec#1781 )
Bumps [@smithy/node-http-handler](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/node-http-handler ) from 4.7.1 to 4.7.3.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/node-http-handler@4.7.3/packages/node-http-handler )
---
updated-dependencies:
- dependency-name: "@smithy/node-http-handler"
dependency-version: 4.7.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
(cherry picked from commit a7c33ae483#1785 )
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.7.0 to 25.9.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.9.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
(cherry picked from commit ffde832a1d#1784 )
Bumps [@aws-sdk/credential-provider-env](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/credential-provider-env ) from 3.972.34 to 3.972.38.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/credential-provider-env/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/credential-provider-env )
---
updated-dependencies:
- dependency-name: "@aws-sdk/credential-provider-env"
dependency-version: 3.972.38
dependency-type: direct:development
update-type: version-update:semver-patch
...
(cherry picked from commit bc1093db1d#1783 )
Bumps [@smithy/property-provider](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/property-provider ) from 4.3.1 to 4.3.3.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/property-provider/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/property-provider@4.3.3/packages/property-provider )
---
updated-dependencies:
- dependency-name: "@smithy/property-provider"
dependency-version: 4.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
(cherry picked from commit fe6ad3af19#1782 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1045.0 to 3.1049.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1049.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1049.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
(cherry picked from commit 4684f47f89support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Michael Lehmann <lehmanmj@amazon.com >
Co-authored-by: Sylvain Verly <sylvain.verly@gmail.com >
2026-05-28 14:44:54 -07:00
217d17914b
fix: allow kubelet token symlink ( #1805 )
...
* Revert "chore: Update dist"
This reverts commit 5548f3441b#1780 )"
This reverts commit 77cd089899#1800 )"
This reverts commit 87eb0cf693Closes #1804
2026-05-28 20:25:29 +00:00
77cd089899
chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity) ( #1780 )
...
* chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity)
Closes #1546
Closes #942
Documents that eks and codebuild work when using the role-chaining flag.
* revert force-skip-oidc changes
* README changes for Container Credentials and adding missing input options
* linting
---------
Co-authored-by: Michael Lehmann <lehmanmj@amazon.com >
2026-05-27 13:42:45 -07:00
87eb0cf693
chore: replay 6.2 devel changes onto main ( #1800 )
...
* chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748 )
* chore(deps-dev): bump vitest from 3.2.4 to 4.1.5
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ) from 3.2.4 to 4.1.5.
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest )
---
updated-dependencies:
- dependency-name: vitest
dependency-version: 4.1.5
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore(deps-dev): update @vitest/coverage-v8
Bump @vitest/coverage-v8 to ^4.1.5 to match peer dependency, and move
vi.mock('node:fs') calls to the top level of test files to reflect
actual hoisting semantics required by vitest 4.x.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tom Keller <kellertk@amazon.com >
(cherry picked from commit 78f374f6d1#1746 )
* chore(deps): bump @actions/core from 2.0.3 to 3.0.1
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core ) from 2.0.3 to 3.0.1.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md )
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core )
---
updated-dependencies:
- dependency-name: "@actions/core"
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore: update test mocks for @actions/core ESM
@actions/core v3 ships as an ESM module with non-configurable exports,
breaking vi.spyOn(). Switch to vi.mock('@actions/core') which
intercepts at the module loader level.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tom Keller <kellertk@amazon.com >
(cherry picked from commit 64d8e82527#1754 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1043.0 to 3.1044.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1044.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1042.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4cfda40a13#1758 )
(cherry picked from commit 39d1702721#1565 )
* Update release-please.yml to auto-update version tag
* chore: configure release-please auto floating tag
---------
Co-authored-by: Tom Keller <kellertk@amazon.com >
(cherry picked from commit c36525a567#1759 )
* Add possibility to input custom session tags
* Use json for input to custom-tags, add documentation for custom-tags
* Add more examples
* Simplify example to avoid parse error
* Add input validation for custom tags
* Fix unit tests for custom-tags
* Add debugging message
* Skip failing test for now
* Build package
* Remove some unused validation for custom tags
* feat: add validation for custom session tags
Harden the custom-tags feature against misuse and
misconfiguration:
- Validate input is a JSON object (reject arrays, primitives, null)
- Enforce STS tag constraints: key length (128), value length (256),
allowed characters
- Reject nested object/array values that would silently stringify to
'[object Object]'
- Block overriding default session tags (GitHub, Repository,
Workflow, etc.)
- Enforce 50-tag session limit
- Warn when custom-tags used with OIDC or web identity
- Fix missing await on helpers test assertion
- Remove unused CUSTOM_TAGS_JSON_INPUTS fixture
- Normalize test mocking to vi.mocked() pattern
---------
Co-authored-by: Sylvain Verly <sylvain.verly@gmail.com >
(cherry picked from commit 61f50f630f#1760 )
(cherry picked from commit dc2353e57a#1762 )
Closes #1067 . This is a advanced option
and is not needed for most deployments.
(cherry picked from commit 8d52d05d7a#1763 )
Closes #1420 .
(cherry picked from commit 07ada0fe07#1764 )
Wraps exportAccountId and validateCredentials calls in retryAndBackoff.
Closes #1681 . Adds a label parameter to retryAndBackoff for better
info-level log messages.
(cherry picked from commit 540d0c13ae#1765 )
Previously invalid role session names would get errors from the STS
API instead of this action rejecting them, causing unnecessary retries.
Now we check them and fail early.
Closes #1656 . That FR recommended that we sanitize the name before
sending to STS, but instead we error to not silently change the user's
selected session name (avoiding the potential security sharp edge)
(cherry picked from commit e35449909c#1766 )
Closes #1238 .
(cherry picked from commit 3f7e1b63d7#1767 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1044.0 to 3.1045.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1045.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit a388f23f7d#1768 )
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8 ) from 4.1.5 to 4.1.6.
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/coverage-v8 )
---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.1.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 1fb495c4b2#1771 )
Bumps [@smithy/property-provider](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/property-provider ) from 4.2.14 to 4.3.1.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/property-provider/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/property-provider@4.3.1/packages/property-provider )
---
updated-dependencies:
- dependency-name: "@smithy/property-provider"
dependency-version: 4.3.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 1ab31502aa#1770 )
Bumps [@smithy/node-http-handler](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/node-http-handler ) from 4.6.1 to 4.7.1.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/node-http-handler@4.7.1/packages/node-http-handler )
---
updated-dependencies:
- dependency-name: "@smithy/node-http-handler"
dependency-version: 4.7.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit dbd503f368#1772 )
Bumps [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ) from 2.4.14 to 2.4.15.
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome )
---
updated-dependencies:
- dependency-name: "@biomejs/biome"
dependency-version: 2.4.15
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7521c55910#1773 )
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.6.0 to 25.7.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.7.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ef734cca81#1774 )
* feat: expose run id in STS client user-agent
Closes #483 .
This commit modifies the user-agent string so that it includes the
GITHUB_RUN_ID and the GITHUB_RUN_ATTEMPT, in the format typically used
by the SDK. User agent strings are logged to CloudTrail, allowing users
to correlate CloudTrail events with GHA runs. We took this approach
instead of logging the ACCESS_KEY_ID as suggested in the issue to avoid
logging sensitive information.
* feat: add github_action to ua string
(cherry picked from commit 29d1be3027#1775 )
Closes #390 .
Note that 50 session tags are the AWS default, and this commit changes
our default set from 7 tags to 15 tags. This commit includes logic to
split the tags into "required" vs "overridable". Required tags are this
action's previous defaults and could never be overridden. Overridable
tags are the new set and can be overridden by custom-tags. The action
will not add tags if the addition plus the required plus the user's
custom tags exceed the AWS limit of 50 total tags. This ensures
backwards compat for the tag additions.
(cherry picked from commit e0ba768507#1776 )
* chore: document forgejo compatibility
* chore: linting fixes
(cherry picked from commit f35a7d7d7e#1778 )
Closes #1554 .
(cherry picked from commit 58e7c47adf#1779 )
* chore: update README for additional claim support
* chore: lint fix (whitespace)
(cherry picked from commit 713aaabfec#1781 )
Bumps [@smithy/node-http-handler](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/node-http-handler ) from 4.7.1 to 4.7.3.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/node-http-handler@4.7.3/packages/node-http-handler )
---
updated-dependencies:
- dependency-name: "@smithy/node-http-handler"
dependency-version: 4.7.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit a7c33ae483#1785 )
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.7.0 to 25.9.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.9.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ffde832a1d#1784 )
Bumps [@aws-sdk/credential-provider-env](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/credential-provider-env ) from 3.972.34 to 3.972.38.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/credential-provider-env/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/credential-provider-env )
---
updated-dependencies:
- dependency-name: "@aws-sdk/credential-provider-env"
dependency-version: 3.972.38
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit bc1093db1d#1783 )
Bumps [@smithy/property-provider](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/property-provider ) from 4.3.1 to 4.3.3.
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases )
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/property-provider/CHANGELOG.md )
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/property-provider@4.3.3/packages/property-provider )
---
updated-dependencies:
- dependency-name: "@smithy/property-provider"
dependency-version: 4.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit fe6ad3af19#1782 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1045.0 to 3.1049.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1049.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1049.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4684f47f89support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Michael Lehmann <lehmanmj@amazon.com >
Co-authored-by: Sylvain Verly <sylvain.verly@gmail.com >
2026-05-26 10:06:35 -07:00
3cc0e19239
chore: unstage devel changes ( #1786 )
...
* Revert "chore: Update dist"
This reverts commit e8614cfbf0#1782 )"
This reverts commit 4684f47f8948b8685c96#1783 )"
This reverts commit fe6ad3af192520c5e921#1784 )"
This reverts commit bc1093db1d#1785 )"
This reverts commit ffde832a1d707acd96f6#1781 )"
This reverts commit a7c33ae483#1779 )"
This reverts commit 713aaabfece6e8eba750#1778 )"
This reverts commit 58e7c47adf#1776 )"
This reverts commit f35a7d7d7e3884f59ecd#1775 )"
This reverts commit e0ba7685076795889618#1774 )"
This reverts commit 29d1be3027#1773 )"
This reverts commit ef734cca81#1772 )"
This reverts commit 7521c55910c0e2737f14#1770 )"
This reverts commit dbd503f36818a236fbd1#1771 )"
This reverts commit 1ab31502aa#1768 )"
This reverts commit 1fb495c4b21e8fec8ea1#1767 )"
This reverts commit a388f23f7d#1766 )"
This reverts commit 3f7e1b63d7#1765 )"
This reverts commit e35449909c958a80fc34#1764 )"
This reverts commit 540d0c13ae#1763 )"
This reverts commit 07ada0fe07f8d4eb68a9#1762 )"
This reverts commit 8d52d05d7a681892c11b#1760 )"
This reverts commit dc2353e57a#1759 )"
This reverts commit 61f50f630f#1565 )"
This reverts commit c36525a567#1758 )"
This reverts commit 39d1702721#1754 )"
This reverts commit 4cfda40a13#1756 )"
This reverts commit 8856e12f3a#1746 )"
This reverts commit 64d8e82527#1748 )"
This reverts commit 78f374f6d1
2026-05-25 12:19:31 -07:00
713aaabfec
chore: update README for additional claim support ( #1779 )
...
* chore: update README for additional claim support
* chore: lint fix (whitespace)
2026-05-14 14:50:49 -07:00
58e7c47adf
fix: skip credential check on output-env-credentials: false ( #1778 )
...
Closes #1554 .
2026-05-14 13:39:34 -07:00
f35a7d7d7e
chore: document forgejo compatibility ( #1776 )
...
* chore: document forgejo compatibility
* chore: linting fixes
2026-05-13 15:49:18 -07:00
e0ba768507
feat: add additional session tags by default ( #1775 )
...
Closes #390 .
Note that 50 session tags are the AWS default, and this commit changes
our default set from 7 tags to 15 tags. This commit includes logic to
split the tags into "required" vs "overridable". Required tags are this
action's previous defaults and could never be overridden. Overridable
tags are the new set and can be overridden by custom-tags. The action
will not add tags if the addition plus the required plus the user's
custom tags exceed the AWS limit of 50 total tags. This ensures
backwards compat for the tag additions.
2026-05-13 14:43:50 -07:00
3f7e1b63d7
chore: update documentation for environment workflows ( #1766 )
...
Closes #1238 .
2026-05-11 23:08:10 +00:00
8d52d05d7a
feat: support custom STS endpoints ( #1762 )
...
Closes #1067 . This is a advanced option
and is not needed for most deployments.
2026-05-07 14:50:17 -07:00
61f50f630f
feat: Allow custom session tags to be passed when assuming a role ( #1759 )
...
* Add possibility to input custom session tags
* Use json for input to custom-tags, add documentation for custom-tags
* Add more examples
* Simplify example to avoid parse error
* Add input validation for custom tags
* Fix unit tests for custom-tags
* Add debugging message
* Skip failing test for now
* Build package
* Remove some unused validation for custom tags
* feat: add validation for custom session tags
Harden the custom-tags feature against misuse and
misconfiguration:
- Validate input is a JSON object (reject arrays, primitives, null)
- Enforce STS tag constraints: key length (128), value length (256),
allowed characters
- Reject nested object/array values that would silently stringify to
'[object Object]'
- Block overriding default session tags (GitHub, Repository,
Workflow, etc.)
- Enforce 50-tag session limit
- Warn when custom-tags used with OIDC or web identity
- Fix missing await on helpers test assertion
- Remove unused CUSTOM_TAGS_JSON_INPUTS fixture
- Normalize test mocking to vi.mocked() pattern
---------
Co-authored-by: Sylvain Verly <sylvain.verly@gmail.com >
2026-05-06 15:22:56 -07:00
a7f0c828ac
feat: Support usage of AWS Profiles ( #1696 )
...
* Support usage of AWS Profiles
* squash merge main updates w feature branch
Squashed commit of the following:
commit ef2df4679f908ff30d5a711258ace2fa906c4bf3
Author: Michael Lehmann <lehmanmj@amazon.com >
Date: Tue Mar 17 11:24:04 2026 -0700
dist update
commit db3779a0e9jf@novatec-gmbh.de >
Date: Sun Dec 21 11:28:36 2025 +0100
Support usage of AWS Profiles
* chore: Update dist
* consistent outputEnvCredentials
* take out tests temporarily
* chore: Update dist
* debug changes for static creds
* remove debug and only cleanup profile if it was set
* formatting fixes + remove profile from cleanup test
* feat: Support usage of AWS Profiles
Adds a config option to support writing to profile files instead of
exporting environment variables.
Closes #1594 . Closes #1586 . Closes #112 .
* chore: fix failing test case and windows path
* chore: lint project markdown files
* chore: update scripts in package.json and tsconfig update
* make env vars consistent, readme linting
* debug for profile path env vars
* remove debug
* remove profile backups
* error if we try to overwrite
* add option to overwrite existing profiles
* tests for overwrite option
* default to no env vars
* remove default from action file
* add static credential env var support
* validation fix for static creds multi profile
* debug sleep for static creds validation
* wait syntax
* undo sleep for creds validate
* test coverage, readme/action yml updates, validate creds later on self-hosted runner
* security dependency updates
* chore(deps-dev): bump @biomejs/biome from 2.4.8 to 2.4.10 (#1709 )
Bumps [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ) from 2.4.8 to 2.4.10.
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.10/packages/@biomejs/biome )
---
updated-dependencies:
- dependency-name: "@biomejs/biome"
dependency-version: 2.4.10
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump @aws-sdk/credential-provider-env (#1713 )
Bumps [@aws-sdk/credential-provider-env](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/credential-provider-env ) from 3.972.22 to 3.972.24.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/credential-provider-env/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/credential-provider-env )
---
updated-dependencies:
- dependency-name: "@aws-sdk/credential-provider-env"
dependency-version: 3.972.24
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: Update dist
* chore(deps): bump @aws-sdk/client-sts from 3.1015.0 to 3.1020.0 (#1710 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts ) from 3.1015.0 to 3.1020.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases )
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md )
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1020.0/clients/client-sts )
---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
dependency-version: 3.1020.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: Update dist
* fix: do not write empty profile files
Also cleanup fix, additional test, README typo cleanup
* linting fix
* chore: linting fix
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Jan Feddern <jf@novatec-gmbh.de >
Co-authored-by: Michael Lehmann <lehmanmj@amazon.com >
Co-authored-by: GitHub Actions <github-aws-sdk-osds-automation@amazon.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 16:27:00 -07:00
11b1c58b24
feat: add skip cleanup option ( #1716 )
...
Closes #1545
2026-04-03 15:00:34 -07:00
7a319c378c
chore: fix links for OpenID Connect subject claims in README ( #1695 )
...
Updated links in README to point to the correct documentation sections for OpenID Connect subject claims.
2026-03-23 16:29:42 -07:00
0f01265ceb
chore: update readme version to v6.0.0 ( #1642 )
2026-02-05 09:53:33 -08:00
4f2ba7fe9c
feat: updates for transitive tagging
2026-01-27 15:56:05 -08:00
a032176f30
chore: update readme version to v5.1.1
2026-01-27 15:45:45 -08:00
fd1fab4c46
Update README.md ( #1544 )
2026-01-27 15:45:45 -08:00
ad637adc0d
chore: update readme version to v5.1.0 ( #1506 )
2026-01-27 15:45:44 -08:00
a87e741eba
feat: Add global timeout support ( #1487 )
2026-01-27 15:45:43 -08:00
af208eb863
chore: update readme version to v5 ( #1469 )
2026-01-27 15:45:43 -08:00
0a6b7158f2
chore: Fix markdown link formatting in README.md ( #1466 )
2026-01-27 15:45:43 -08:00
ecfe99e00b
chore: update README with versioning ( #1465 )
...
* chore: update README with versioning and license info
* chore: fix typo
2026-01-27 15:45:43 -08:00
9fb1716ceb
feat: support account id allowlist ( #1456 )
...
* feat: support account id allowlist
* chore: update readme
---------
Co-authored-by: Michael Lehmann <lehmanmj@amazon.com >
2026-01-27 15:45:43 -08:00
4f0bc4ee1c
feat: add skip OIDC option ( #1458 )
2026-01-27 15:45:43 -08:00
80ed412f2c
fix: update readme to 4.3.1 ( #1424 )
...
This is a fix instead of a chore to force a 4.3.1 tag
Release-as: 4.3.1
2026-01-27 15:44:32 -08:00
979931c880
Update README.md
...
update readme with latest version
2026-01-27 15:44:32 -08:00
5858805023
Revert "Merge pull request #1415 from aws-actions/lehmanmj-patch-1"
2026-01-27 15:44:32 -08:00
2a9d16e130
Update README.md
...
update README to note that authenticated-arn value is output.
also changed version numbers to reflect new version.
2026-01-27 15:44:32 -08:00
a16a4a650d
fix(docs): readme samples versioning
2026-01-27 15:44:09 -08:00
5106596545
Update README.md
...
note that the expiration is listed in the readme as an output.
2026-01-27 15:44:07 -08:00
09c6ab0945
Update README.md - Spelling correction
2026-01-27 15:43:50 -08:00
9520a4e0cd
chore: Revise readme
2026-01-27 15:43:50 -08:00
09242f526d
docs: fix the wrong example region for China partitation
2026-01-27 15:43:50 -08:00
e378c2d267
fix to make action still run
2026-01-27 15:43:50 -08:00
12acc19c37
add output-env-credentials flag (defaults to true)
2026-01-27 15:43:46 -08:00
3efb5d271f
Update README.md
...
Fixed README to reflect the actual names of the output variables
2026-01-27 15:42:54 -08:00
5f34186b4f
document outputs in readme
2026-01-27 15:42:54 -08:00
bd4992e70f
Update README.md
...
update readme.md to provide a suggestion for altering the role-session-name for easier auditability
2026-01-27 15:42:53 -08:00
640ff09de4
Update README.md
2026-01-27 15:42:53 -08:00
cd5db3dc55
Update README.md
...
Updated version tags in examples to reflect the latest semantic version.
2026-01-27 15:42:53 -08:00
232435c0c0
feat: add support to define transitive tag keys
2025-03-28 14:37:26 +01:00
eb70354fb4
feat: idempotent fetch ( #1289 )
...
* Add functionality to re-use existing credentials
* Finish adding use-existing-credentials logic
* Add testing for use-existing-credentials
* Update README
* feat: finalize use-exisiting-credentials feature
---------
Co-authored-by: Tom Keller <kellertk@amazon.com >
2025-02-07 16:24:45 -08:00
e0fc2428cc
Update example ARN of China Role ( #1025 )
...
Co-authored-by: Tom Keller <1083460+kellertk@users.noreply.github.com >
2024-03-12 17:17:29 +00:00
c754bf3531
chore: minor README update
2024-02-16 10:19:19 -08:00
0a785df9d6
chore: fix README typos
2024-02-16 10:13:23 -08:00
f6445e06fc
chore: minor README update
2024-02-09 17:00:57 -08:00
40c1389cab
chore: minor README update
2024-02-09 16:57:50 -08:00
01c96af67c
chore: update README
...
* Removed table of contents (auto-generated by GitHub now)
* Added list of option section
* Reformatted to 80 columns where possible
* Clarified that we use the JS credential flow. Fixes #962
* Mention role name limitation. Fixes #953
2024-02-09 16:49:12 -08:00
Tom Keller