chore: remove outdated examples

All of the examples were out of date and we do not have a mechanism for keeping them up to date. Removed the examples.
fix: omit account IDs from the allowed-account-ids failure message
2026-09-02 05:55:10 +09:00 · 2026-08-31 13:26:19 -07:00 · 2026-08-31 13:18:21 -07:00 · 2026-08-31 13:18:21 -07:00 · 2026-08-31 13:01:39 -07:00 · 2026-08-31 12:52:53 -07:00
7 changed files with 2195 additions and 1459 deletions
@@ -1,5 +1,5 @@
 {
  ".release-please-manifest.json": "4.0.2",
  "package.json": "6.0.0",
-  ".": "6.2.4"
+  ".": "6.2.3"
 }
@@ -2,14 +2,6 @@

 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

-## [6.2.4](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.3...v6.2.4) (2026-08-31)
-
-
-### Bug Fixes
-
-* account-ids handling, mask proxy as secret in logs ([#1943](https://github.com/aws-actions/configure-aws-credentials/issues/1943)) ([aa65264](https://github.com/aws-actions/configure-aws-credentials/commit/aa6526434b08748f8776b29964e3f1f5d90e7b63))
-* skip backoff sleep after the final retryAndBackoff attempt ([#1937](https://github.com/aws-actions/configure-aws-credentials/issues/1937)) ([3852440](https://github.com/aws-actions/configure-aws-credentials/commit/3852440c21363386b7b790605685d08a7c1a4876))
-
 ## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)


@@ -61,7 +61,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
       runs-on: ubuntu-latest
       steps:
         - name: Configure AWS Credentials
-           uses: aws-actions/configure-aws-credentials@v6.2.4
+           uses: aws-actions/configure-aws-credentials@v6.2.3
           with:
             role-to-assume: <Role ARN you created in step 2>
             aws-region: <AWS Region you want to use>
@@ -250,7 +250,7 @@ specify the profile name as an environment variable in the job step:

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-role
@@ -268,14 +268,14 @@ step environment variables:

 ```yaml
 - name: Configure AWS credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-first-role
    aws-profile: firstRoleInChain

 - name: assume second role
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -311,7 +311,7 @@ this action will always consider the `HTTP_PROXY` environment variable.
 Manually configured proxy:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.4
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  aws-region: us-east-2
  role-to-assume: my-github-actions-role
@@ -458,7 +458,7 @@ line.
 <summary>Inline session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.4
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
 ```
@@ -466,7 +466,7 @@ with:
 Or we can have a nicely formatted JSON as well:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.4
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  inline-session-policy: >-
    {
@@ -494,7 +494,7 @@ the role.
 <summary>Managed session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.4
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
@@ -502,7 +502,7 @@ with:
 And we can pass multiple managed policies likes this:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.4
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  managed-session-policies: |
    arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -548,7 +548,7 @@ specify the audience through the `audience` input:

 ```yaml
 - name: Configure AWS Credentials for China region audience
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    audience: sts.amazonaws.com.cn
    aws-region: cn-northwest-1
@@ -709,7 +709,7 @@ Provider. The audience would still be `sts.amazonaws.com` by default.

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -725,13 +725,13 @@ environment variable and use it to assume the role

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    role-session-name: MySessionName
 - name: Configure other AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -753,7 +753,7 @@ alternatively, the `TagSession` permission can be omitted if you are using the

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -774,7 +774,7 @@ like `role-to-assume: my-github-actions-role`.
 ```yaml
 - name: Configure AWS Credentials 1
  id: creds
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -783,7 +783,7 @@ like `role-to-assume: my-github-actions-role`.
  run: |
    aws sts get-caller-identity
 - name: Configure AWS Credentials 2
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
@@ -814,14 +814,14 @@ provided.

 ```yaml
 - name: Configure AWS Credentials for Dev
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::111111111111:role/dev-role
    aws-profile: dev

 - name: Configure AWS Credentials for Prod
-  uses: aws-actions/configure-aws-credentials@v6.2.4
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-west-2
    role-to-assume: arn:aws:iam::222222222222:role/prod-role
@@ -222,7 +222,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 The following npm package may be included in this product:

- - @aws-sdk/client-sts@3.1121.0
+ - @aws-sdk/client-sts@3.1116.0

 This package contains the following license:

@@ -1,7 +1,7 @@
 {
  "name": "configure-aws-credentials",
  "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.4",
+  "version": "6.2.3",
  "scripts": {
    "build": "tsc",
    "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -18,23 +18,23 @@
  },
  "devDependencies": {
    "@aws-sdk/credential-provider-env": "^3.972.70",
-    "@biomejs/biome": "2.5.11",
+    "@biomejs/biome": "2.5.10",
    "@smithy/property-provider": "^4.5.2",
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.2.0",
    "@vitest/coverage-v8": "4.1.10",
    "aws-sdk-client-mock": "^4.1.0",
    "esbuild": "^0.28.2",
-    "generate-license-file": "^4.2.4",
+    "generate-license-file": "^4.2.1",
    "json-schema": "^0.4.0",
    "markdownlint-cli": "^0.49.1",
    "memfs": "^4.68.1",
    "standard-version": "^9.5.0",
    "typescript": "^7.0.2",
-    "vitest": "4.1.11"
+    "vitest": "4.1.10"
  },
  "dependencies": {
    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1121.0",
+    "@aws-sdk/client-sts": "^3.1116.0",
    "@aws-sdk/credential-provider-node": "^3.972.63",
    "@smithy/node-http-handler": "^4.11.3",
    "proxy-agent": "^8.0.2"
Author	SHA1	Message	Date
Tom Keller	a1829d0ba1	chore: remove outdated examples All of the examples were out of date and we do not have a mechanism for keeping them up to date. Removed the examples.	2026-08-31 13:26:19 -07:00
Tom Keller	4b8b5e37b4	fix: omit account IDs from the allowed-account-ids failure message The mismatch error is thrown before exportAccountId registers the account-id mask, so setFailed wrote the raw account ID (and the configured allow-list) into a public annotation. (C4)	2026-08-31 13:18:21 -07:00
Tom Keller	a05dfa82bd	fix: mask proxy URL credentials in job logs Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment variables was never registered as a secret, so error messages carrying the proxy URL printed the credentials unmasked in the job log.	2026-08-31 13:18:21 -07:00
Tom Keller	378a941623	fix: honor configured STS endpoint for "ambient" credentials Ambient credential resolution built a bare STS client, so a web-identity token found by the SDK default chain (e.g. AWS_WEB_IDENTITY_TOKEN_FILE on a self-hosted runner) was exchanged with public STS instead of any operator-configured sts-endpoint. Resolution now passes the configured region, endpoint, and proxy handler to the default provider chain.	2026-08-31 13:01:39 -07:00
Tom Keller	82408b69eb	fix: reject newlines in names and values when writing profile files If the profile file writing was enabled, we emitted newlines into the file verbatim, permitting injecting arbitrary profiles into the file. Writing now fails instead.	2026-08-31 12:52:53 -07:00
Tom Keller	1f2d3ed486	fix: enforce allowed-account-ids on the use-existing-credentials path The early return for valid pre-existing credentials skipped the allowed-account-ids check, now included.	2026-08-31 12:48:42 -07:00
Tom Keller	ed5da29eb9	fix: enforce allowed-account-ids when the list contains empty entries An empty first element previously short-circuited the allowed account check. Empty entries are now filtered out and validation applies whenever any non-empty entry exists.	2026-08-31 12:30:08 -07:00