chore(main): release 6.2.3 (#1878)

Closes #1898.

Due to a bundling, checking for `error instanceof
PackedPolicyTooLargeException` fails. Instead we need to explicitly
check for `error.name`.

.github/workflows/release-please.yml

@@ -55,6 +55,8 @@
           run: |
             git config user.name "GitHub Actions"
             git config user.email "github-aws-sdk-osds-automation@amazon.com"
+            echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
+            git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
             if git rev-parse "v${{ steps.release.outputs.major }}" >/dev/null 2>&1; then
               git tag -d "v${{ steps.release.outputs.major }}"
               git push origin ":v${{ steps.release.outputs.major }}"

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "6.0.0",
-  ".": "6.2.2"
+  ".": "6.2.3"
 }

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
+
+
+### Bug Fixes
+
+* attach git credentials before Tag Major Version push ([#1877](https://github.com/aws-actions/configure-aws-credentials/issues/1877)) ([9ae780b](https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482))
+* PackedPolicyTooLarge detection in STS tags ([#1899](https://github.com/aws-actions/configure-aws-credentials/issues/1899)) ([fa8d6a5](https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb))
+
 ## [6.2.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2) (2026-07-07)
 
 

README.md

@@ -26,7 +26,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
          "Condition": {
            "StringEquals": {
              "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
+             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>@<ORG_ID>/<GITHUB_REPOSITORY>@<REPO_ID>:ref:refs/heads/<GITHUB_BRANCH>"
            }
          }
        }
@@ -36,11 +36,16 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
 
    </details>
 
-   Note: if you are running in a GitHub environment based workflow, the value
+   Note: The value of the `sub` claim may be different depending on the workflow
-   for the Sub claim will be different, in the form of
+   and the environment in which it's running. Workflows in repositories created
-   `repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:environment:<ENVIRONMENT_NAME>`.
+   prior to [15 July 2026][immutable-sub] will omit the `@<ORG_ID>` and
-   Adjust the trust policy accordingly if you are using environment-based
+   `@<REPO_ID>` suffixes unless opted in. Workflows running in GitHub
-   workflows.
+   environments will include an`environment:<ENVIRONMENT_NAME>` stanza.  See
+   [Claims and scoping permissions](#claims-and-scoping-permissions) for more
+   information.
+
+   [immutable-sub]:
+   https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/
 
 3. Attach permissions to the IAM Role that allow it to access the AWS resources
    you need.
@@ -593,6 +598,29 @@ claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
 > unintended access. Instead, use `StringEquals` or `StringLike` operators to
 > check for specific claim values.
 
+#### Immutable subject claims
+
+Repositories created on github.com on or after 15 July 2026, and older
+repositories that have opted in, emit an [immutable `sub` claim][immutable-sub].
+This claim appends the permanent numeric ID of the organization and of the
+repository after each name, separated by `@`, so that a recycled org or
+repository name cannot be used to mint tokens matching a stale trust policy.
+For example:
+
+```text
+# Legacy (mutable) sub claim
+repo:octo-org/octo-repo:ref:refs/heads/main
+
+# Immutable sub claim
+repo:octo-org@123456/octo-repo@789012:ref:refs/heads/main
+```
+
+If your trust policy matches the legacy name-only form and your repository emits
+the immutable claim, `AssumeRoleWithWebIdentity` fails with `Not authorized to
+perform sts:AssumeRoleWithWebIdentity`. To fix this, update the `sub` condition
+to the immutable form. You can find your repository's prefix in the Settings,
+or by following the token inspection steps below.
+
 [least-privilege]:
   https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
 [gh-blog-oidc]:
@@ -605,7 +633,7 @@ claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
 If you aren't sure what claim values your workflow is producing, the
 [`actions-oidc-debugger`](https://github.com/github/actions-oidc-debugger)
 action will print the decoded JWT payload. Run it in a private repository
-only — the token itself is short-lived but the claim values may be sensitive.
+only; the token itself is short-lived but the claim values may be sensitive.
 
 See the GitHub [security-hardening guide][gh-oidc-hardening] for further
 discussion of trust conditions and threat modeling.

THIRD-PARTY

@@ -222,7 +222,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/client-sts@3.1080.0
+ - @aws-sdk/client-sts@3.1091.0
 
 This package contains the following license:
 
@@ -432,9 +432,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.38
+ - @aws-sdk/signature-v4-multi-region@3.996.41
- - @smithy/core@3.29.1
+ - @smithy/core@3.29.6
- - @smithy/types@4.15.1
+ - @smithy/types@4.16.1
 
 These packages each contain the following license:
 
@@ -832,7 +832,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.974.28
+ - @aws-sdk/core@3.975.3
 
 This package contains the following license:
 
@@ -1042,16 +1042,16 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.54
+ - @aws-sdk/credential-provider-env@3.972.59
- - @aws-sdk/credential-provider-ini@3.972.61
+ - @aws-sdk/credential-provider-ini@3.973.4
- - @aws-sdk/credential-provider-node@3.972.63
+ - @aws-sdk/credential-provider-node@3.972.70
- - @aws-sdk/token-providers@3.1080.0
+ - @aws-sdk/token-providers@3.1088.0
- - @aws-sdk/types@3.973.15
+ - @aws-sdk/types@3.974.2
- - @aws-sdk/xml-builder@3.972.33
+ - @aws-sdk/xml-builder@3.972.36
- - @smithy/credential-provider-imds@4.4.6
+ - @smithy/credential-provider-imds@4.4.11
- - @smithy/fetch-http-handler@5.6.3
+ - @smithy/fetch-http-handler@5.6.8
- - @smithy/node-http-handler@4.9.3
+ - @smithy/node-http-handler@4.9.8
- - @smithy/signature-v4@5.6.2
+ - @smithy/signature-v4@5.6.7
 
 These packages each contain the following license:
 
@@ -1261,9 +1261,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.54
+ - @aws-sdk/credential-provider-process@3.972.59
- - @aws-sdk/credential-provider-sso@3.972.60
+ - @aws-sdk/credential-provider-sso@3.973.3
- - @aws-sdk/credential-provider-web-identity@3.972.60
+ - @aws-sdk/credential-provider-web-identity@3.972.65
 
 These packages each contain the following license:
 
@@ -1473,9 +1473,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.56
+ - @aws-sdk/credential-provider-http@3.972.61
- - @aws-sdk/credential-provider-login@3.972.60
+ - @aws-sdk/credential-provider-login@3.972.66
- - @aws-sdk/nested-clients@3.997.28
+ - @aws-sdk/nested-clients@3.997.33
 
 These packages each contain the following license:
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "scripts": {
     "build": "tsc",
     "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,25 +17,25 @@
     "organization": true
   },
   "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.49",
+    "@aws-sdk/credential-provider-env": "^3.972.59",
-    "@biomejs/biome": "2.5.2",
+    "@biomejs/biome": "2.5.4",
-    "@smithy/property-provider": "^4.4.6",
+    "@smithy/property-provider": "^4.4.11",
-    "@types/node": "^26.1.0",
+    "@types/node": "^26.1.1",
     "@vitest/coverage-v8": "4.1.10",
     "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.28.1",
     "generate-license-file": "^4.2.1",
     "json-schema": "^0.4.0",
-    "markdownlint-cli": "^0.49.0",
+    "markdownlint-cli": "^0.49.1",
-    "memfs": "^4.58.0",
+    "memfs": "^4.64.0",
     "standard-version": "^9.5.0",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vitest": "4.1.10"
   },
   "dependencies": {
     "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1080.0",
+    "@aws-sdk/client-sts": "^3.1091.0",
-    "@smithy/node-http-handler": "^4.9.1",
+    "@smithy/node-http-handler": "^4.9.8",
     "proxy-agent": "^8.0.2"
   },
   "keywords": [

src/assumeRole.ts

@@ -2,11 +2,7 @@ import assert from 'node:assert';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
-import {
+import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
-  AssumeRoleCommand,
-  AssumeRoleWithWebIdentityCommand,
-  PackedPolicyTooLargeException,
-} from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
 import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';
 
@@ -65,7 +61,7 @@ async function assumeRoleWithCredentials(params: AssumeRoleCommandInput, client:
     const creds = await client.send(new AssumeRoleCommand({ ...params }));
     return creds;
   } catch (error) {
-    if (error instanceof PackedPolicyTooLargeException) {
+    if ((error as { name?: string })?.name === 'PackedPolicyTooLargeException') {
       core.info('Session tag size is too large; dropping droppable tags and retrying.');
       const droppableKeys = new Set(DROPPABLE_TAG_SOURCES.map((s) => s.key));
       params.Tags = params.Tags?.filter((tag) => !droppableKeys.has(tag.Key ?? ''));

test/index.test.ts

@@ -3,7 +3,6 @@ import {
   AssumeRoleCommand,
   AssumeRoleWithWebIdentityCommand,
   GetCallerIdentityCommand,
-  PackedPolicyTooLargeException,
   STSClient,
 } from '@aws-sdk/client-sts';
 import { mockClient } from 'aws-sdk-client-mock';
@@ -331,10 +330,11 @@ describe('Configure AWS Credentials', {}, () => {
     });
     it('drops droppable tags and retries on PackedPolicyTooLargeException', {}, async () => {
       vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.IAM_ASSUMEROLE_INPUTS));
-      mockedSTSClient
+      // Reject with a plain error carrying only the `name`, NOT an instance of the SDK class. This
-        .on(AssumeRoleCommand)
+      // mirrors the bundled action, where the error can be deserialized by a second, non-identical
-        .rejectsOnce(new PackedPolicyTooLargeException({ message: 'too large', $metadata: {} }))
+      // copy of PackedPolicyTooLargeException so `instanceof` fails; the recovery must key off `name`.
-        .resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      const packedPolicyError = Object.assign(new Error('too large'), { name: 'PackedPolicyTooLargeException' });
+      mockedSTSClient.on(AssumeRoleCommand).rejectsOnce(packedPolicyError).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
       await run();
       expect(core.info).toHaveBeenCalledWith('Session tag size is too large; dropping droppable tags and retrying.');
       const retryInput = mockedSTSClient.commandCalls(AssumeRoleCommand)[1].args[0].input;