fix: attach git credentials before Tag Major Version push

The Tag Major Version step ran 'git push origin' after Checkout Again re-cloned with persist-credentials: false, leaving the remote without credentials. This caused 'fatal: could not read Username' (exit 128) on the first release. Set the authenticated remote URL using OSDS_ACCESS_TOKEN before pushing tags, mirroring the Update README step.
2026-08-26 04:45:10 +09:00 · 2026-07-09 12:25:02 -07:00
11 changed files with 4364 additions and 6323 deletions
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Stale issue job
    steps:
-    - uses: aws-actions/stale-issue-cleanup@v7
+    - uses: aws-actions/stale-issue-cleanup@v6
      with:
        # Setting messages to an empty string will cause the automation to skip
        # that category
@@ -1,5 +1,5 @@
 {
  ".release-please-manifest.json": "4.0.2",
  "package.json": "6.0.0",
-  ".": "6.2.3"
+  ".": "6.2.2"
 }
@@ -2,14 +2,6 @@

 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

-## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
-
-
-### Bug Fixes
-
-* attach git credentials before Tag Major Version push ([#1877](https://github.com/aws-actions/configure-aws-credentials/issues/1877)) ([9ae780b](https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482))
-* PackedPolicyTooLarge detection in STS tags ([#1899](https://github.com/aws-actions/configure-aws-credentials/issues/1899)) ([fa8d6a5](https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb))
-
 ## [6.2.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2) (2026-07-07)


@@ -26,7 +26,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
         "Condition": {
           "StringEquals": {
             "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>@<ORG_ID>/<GITHUB_REPOSITORY>@<REPO_ID>:ref:refs/heads/<GITHUB_BRANCH>"
+             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
           }
         }
       }
@@ -36,16 +36,11 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with

   </details>

-   Note: The value of the `sub` claim may be different depending on the workflow
-   and the environment in which it's running. Workflows in repositories created
-   prior to [15 July 2026][immutable-sub] will omit the `@<ORG_ID>` and
-   `@<REPO_ID>` suffixes unless opted in. Workflows running in GitHub
-   environments will include an`environment:<ENVIRONMENT_NAME>` stanza.  See
-   [Claims and scoping permissions](#claims-and-scoping-permissions) for more
-   information.
-
-   [immutable-sub]:
-   https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/
+   Note: if you are running in a GitHub environment based workflow, the value
+   for the Sub claim will be different, in the form of
+   `repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:environment:<ENVIRONMENT_NAME>`.
+   Adjust the trust policy accordingly if you are using environment-based
+   workflows.

 3. Attach permissions to the IAM Role that allow it to access the AWS resources
   you need.
@@ -61,7 +56,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
       runs-on: ubuntu-latest
       steps:
         - name: Configure AWS Credentials
-           uses: aws-actions/configure-aws-credentials@v6.2.3
+           uses: aws-actions/configure-aws-credentials@v6.1.0
           with:
             role-to-assume: <Role ARN you created in step 2>
             aws-region: <AWS Region you want to use>
@@ -250,7 +245,7 @@ specify the profile name as an environment variable in the job step:

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-role
@@ -268,14 +263,14 @@ step environment variables:

 ```yaml
 - name: Configure AWS credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-first-role
    aws-profile: firstRoleInChain

 - name: assume second role
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -311,7 +306,7 @@ this action will always consider the `HTTP_PROXY` environment variable.
 Manually configured proxy:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
  aws-region: us-east-2
  role-to-assume: my-github-actions-role
@@ -458,7 +453,7 @@ line.
 <summary>Inline session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
  inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
 ```
@@ -466,7 +461,7 @@ with:
 Or we can have a nicely formatted JSON as well:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
  inline-session-policy: >-
    {
@@ -494,7 +489,7 @@ the role.
 <summary>Managed session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
  managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
@@ -502,7 +497,7 @@ with:
 And we can pass multiple managed policies likes this:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
  managed-session-policies: |
    arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -548,7 +543,7 @@ specify the audience through the `audience` input:

 ```yaml
 - name: Configure AWS Credentials for China region audience
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    audience: sts.amazonaws.com.cn
    aws-region: cn-northwest-1
@@ -598,29 +593,6 @@ claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
 > unintended access. Instead, use `StringEquals` or `StringLike` operators to
 > check for specific claim values.

-#### Immutable subject claims
-
-Repositories created on github.com on or after 15 July 2026, and older
-repositories that have opted in, emit an [immutable `sub` claim][immutable-sub].
-This claim appends the permanent numeric ID of the organization and of the
-repository after each name, separated by `@`, so that a recycled org or
-repository name cannot be used to mint tokens matching a stale trust policy.
-For example:
-
-```text
-# Legacy (mutable) sub claim
-repo:octo-org/octo-repo:ref:refs/heads/main
-
-# Immutable sub claim
-repo:octo-org@123456/octo-repo@789012:ref:refs/heads/main
-```
-
-If your trust policy matches the legacy name-only form and your repository emits
-the immutable claim, `AssumeRoleWithWebIdentity` fails with `Not authorized to
-perform sts:AssumeRoleWithWebIdentity`. To fix this, update the `sub` condition
-to the immutable form. You can find your repository's prefix in the Settings,
-or by following the token inspection steps below.
-
 [least-privilege]:
  https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
 [gh-blog-oidc]:
@@ -633,7 +605,7 @@ or by following the token inspection steps below.
 If you aren't sure what claim values your workflow is producing, the
 [`actions-oidc-debugger`](https://github.com/github/actions-oidc-debugger)
 action will print the decoded JWT payload. Run it in a private repository
-only; the token itself is short-lived but the claim values may be sensitive.
+only — the token itself is short-lived but the claim values may be sensitive.

 See the GitHub [security-hardening guide][gh-oidc-hardening] for further
 discussion of trust conditions and threat modeling.
@@ -708,7 +680,7 @@ Provider. The audience would still be `sts.amazonaws.com` by default.

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -724,13 +696,13 @@ environment variable and use it to assume the role

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    role-session-name: MySessionName
 - name: Configure other AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -752,7 +724,7 @@ alternatively, the `TagSession` permission can be omitted if you are using the

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -773,7 +745,7 @@ like `role-to-assume: my-github-actions-role`.
 ```yaml
 - name: Configure AWS Credentials 1
  id: creds
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -782,7 +754,7 @@ like `role-to-assume: my-github-actions-role`.
  run: |
    aws sts get-caller-identity
 - name: Configure AWS Credentials 2
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-2
    aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
@@ -813,14 +785,14 @@ provided.

 ```yaml
 - name: Configure AWS Credentials for Dev
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::111111111111:role/dev-role
    aws-profile: dev

 - name: Configure AWS Credentials for Prod
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
  with:
    aws-region: us-west-2
    role-to-assume: arn:aws:iam::222222222222:role/prod-role
@@ -222,7 +222,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 The following npm package may be included in this product:

- - @aws-sdk/client-sts@3.1101.0
+ - @aws-sdk/client-sts@3.1080.0

 This package contains the following license:

@@ -432,9 +432,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/signature-v4-multi-region@3.996.43
- - @smithy/core@3.31.1
- - @smithy/types@4.16.1
+ - @aws-sdk/signature-v4-multi-region@3.996.38
+ - @smithy/core@3.29.1
+ - @smithy/types@4.15.1

 These packages each contain the following license:

@@ -832,7 +832,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 The following npm package may be included in this product:

- - @aws-sdk/core@3.977.5
+ - @aws-sdk/core@3.974.28

 This package contains the following license:

@@ -1042,16 +1042,16 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-env@3.972.66
- - @aws-sdk/credential-provider-ini@3.973.11
- - @aws-sdk/credential-provider-node@3.972.77
- - @aws-sdk/token-providers@3.1102.0
- - @aws-sdk/types@3.974.2
- - @aws-sdk/xml-builder@3.972.37
- - @smithy/credential-provider-imds@4.4.16
- - @smithy/fetch-http-handler@5.6.13
- - @smithy/node-http-handler@4.9.13
- - @smithy/signature-v4@5.6.12
+ - @aws-sdk/credential-provider-env@3.972.54
+ - @aws-sdk/credential-provider-ini@3.972.61
+ - @aws-sdk/credential-provider-node@3.972.63
+ - @aws-sdk/token-providers@3.1080.0
+ - @aws-sdk/types@3.973.15
+ - @aws-sdk/xml-builder@3.972.33
+ - @smithy/credential-provider-imds@4.4.6
+ - @smithy/fetch-http-handler@5.6.3
+ - @smithy/node-http-handler@4.9.3
+ - @smithy/signature-v4@5.6.2

 These packages each contain the following license:

@@ -1261,9 +1261,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-process@3.972.66
- - @aws-sdk/credential-provider-sso@3.973.10
- - @aws-sdk/credential-provider-web-identity@3.972.72
+ - @aws-sdk/credential-provider-process@3.972.54
+ - @aws-sdk/credential-provider-sso@3.972.60
+ - @aws-sdk/credential-provider-web-identity@3.972.60

 These packages each contain the following license:

@@ -1473,9 +1473,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-http@3.972.68
- - @aws-sdk/credential-provider-login@3.972.73
- - @aws-sdk/nested-clients@3.997.40
+ - @aws-sdk/credential-provider-http@3.972.56
+ - @aws-sdk/credential-provider-login@3.972.60
+ - @aws-sdk/nested-clients@3.997.28

 These packages each contain the following license:

@@ -1485,7 +1485,7 @@ Apache-2.0

 The following npm package may be included in this product:

- - ip-address@10.4.0
+ - ip-address@10.2.0

 This package contains the following license:

@@ -1740,7 +1740,7 @@ SOFTWARE.

 The following npm package may be included in this product:

- - undici@6.28.0
+ - undici@6.27.0

 This package contains the following license:

@@ -1929,11 +1929,7 @@ var require_request = __commonJS({
          } else if (typeof val[i] === "object") {
            throw new InvalidArgumentError(`invalid ${key} header`);
          } else {
-            const str = `${val[i]}`;
-            if (!isValidHeaderValue(str)) {
-              throw new InvalidArgumentError(`invalid ${key} header`);
-            }
-            arr.push(str);
+            arr.push(`${val[i]}`);
          }
        }
        val = arr;
@@ -1945,9 +1941,6 @@ var require_request = __commonJS({
        val = "";
      } else {
        val = `${val}`;
-        if (!isValidHeaderValue(val)) {
-          throw new InvalidArgumentError(`invalid ${key} header`);
-        }
      }
      if (headerName === "host") {
        if (request.host !== null) {
@@ -5678,7 +5671,6 @@ var require_client_h1 = __commonJS({
      RequestContentLengthMismatchError,
      ResponseContentLengthMismatchError,
      RequestAbortedError,
-      InvalidArgumentError,
      HeadersTimeoutError,
      HeadersOverflowError,
      SocketError,
@@ -6405,16 +6397,8 @@ var require_client_h1 = __commonJS({
        }
        body = bodyStream.stream;
        contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null) {
-        const contentType = body.type;
-        if (contentType) {
-          const contentTypeValue = `${contentType}`;
-          if (!util.isValidHeaderValue(contentTypeValue)) {
-            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
-            return false;
-          }
-          headers.push("content-type", contentTypeValue);
-        }
+      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
+        headers.push("content-type", body.type);
      }
      if (body && typeof body.read === "function") {
        body.read(0);
@@ -8966,24 +8950,6 @@ var require_retry_handler = __commonJS({
      const current = Date.now();
      return new Date(retryAfter).getTime() - current;
    }
-    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
-      const contentLength = headers["content-length"];
-      if (contentLength == null) {
-        return null;
-      }
-      if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
-        return null;
-      }
-      const length = Number(contentLength);
-      const expectedLength = range.end - range.start + 1;
-      if (!Number.isFinite(length) || length !== expectedLength) {
-        return new RequestRetryError("Content-Length mismatch", statusCode, {
-          headers,
-          data: { count: retryCount }
-        });
-      }
-      return null;
-    }
    var RetryHandler = class _RetryHandler {
      constructor(opts, handlers) {
        const { retryOptions, ...dispatchOpts } = opts;
@@ -9156,11 +9122,6 @@ var require_retry_handler = __commonJS({
            );
            return false;
          }
-          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
-          if (contentLengthError != null) {
-            this.abort(contentLengthError);
-            return false;
-          }
          const { start, size, end = size - 1 } = contentRange;
          assert(this.start === start, "content-range mismatch");
          assert(this.end == null || this.end === end, "content-range mismatch");
@@ -9178,11 +9139,6 @@ var require_retry_handler = __commonJS({
                statusMessage
              );
            }
-            const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
-            if (contentLengthError != null) {
-              this.abort(contentLengthError);
-              return false;
-            }
            const { start, size, end = size - 1 } = range;
            assert(
              start != null && Number.isFinite(start),
@@ -16028,48 +15984,14 @@ var require_util6 = __commonJS({
      for (let i = 0; i < path.length; ++i) {
        const code = path.charCodeAt(i);
        if (code < 32 || // exclude CTLs (0-31)
-        code > 126 || // exclude DEL and non-ascii
+        code === 127 || // DEL
        code === 59) {
          throw new Error("Invalid cookie path");
        }
      }
    }
-    function isLetterOrDigit(code) {
-      return code >= 48 && code <= 57 || // 0-9
-      code >= 65 && code <= 90 || // A-Z
-      code >= 97 && code <= 122;
-    }
    function validateCookieDomain(domain) {
-      if (domain === " ") {
-        return;
-      }
-      if (domain.length > 255) {
-        throw new Error("Invalid cookie domain");
-      }
-      let labelLength = 0;
-      for (let i = 0; i < domain.length; ++i) {
-        const code = domain.charCodeAt(i);
-        if (code === 46) {
-          if (labelLength === 0) {
-            throw new Error("Invalid cookie domain");
-          }
-          if (domain.charCodeAt(i - 1) === 45) {
-            throw new Error("Invalid cookie domain");
-          }
-          labelLength = 0;
-          continue;
-        }
-        if (labelLength === 0 && !isLetterOrDigit(code)) {
-          throw new Error("Invalid cookie domain");
-        }
-        if (!isLetterOrDigit(code) && code !== 45) {
-          throw new Error("Invalid cookie domain");
-        }
-        if (++labelLength > 63) {
-          throw new Error("Invalid cookie domain");
-        }
-      }
-      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
+      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
        throw new Error("Invalid cookie domain");
      }
    }
@@ -16152,11 +16074,7 @@ var require_util6 = __commonJS({
          throw new Error("Invalid unparsed");
        }
        const [key, ...value] = part.split("=");
-        const trimmedKey = key.trim();
-        const joinedValue = value.join("=");
-        validateCookieName(trimmedKey);
-        validateCookieValue(joinedValue);
-        out.push(`${trimmedKey}=${joinedValue}`);
+        out.push(`${key.trim()}=${value.join("=")}`);
      }
      return out.join("; ");
    }
@@ -1,7 +1,7 @@
 {
  "name": "configure-aws-credentials",
  "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.3",
+  "version": "6.2.2",
  "scripts": {
    "build": "tsc",
    "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,25 +17,25 @@
    "organization": true
  },
  "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.65",
-    "@biomejs/biome": "2.5.6",
-    "@smithy/property-provider": "^4.4.16",
-    "@types/node": "^26.1.2",
+    "@aws-sdk/credential-provider-env": "^3.972.49",
+    "@biomejs/biome": "2.5.2",
+    "@smithy/property-provider": "^4.4.6",
+    "@types/node": "^26.1.0",
    "@vitest/coverage-v8": "4.1.10",
    "aws-sdk-client-mock": "^4.1.0",
    "esbuild": "^0.28.1",
    "generate-license-file": "^4.2.1",
    "json-schema": "^0.4.0",
-    "markdownlint-cli": "^0.49.1",
-    "memfs": "^4.64.0",
+    "markdownlint-cli": "^0.49.0",
+    "memfs": "^4.58.0",
    "standard-version": "^9.5.0",
-    "typescript": "^7.0.2",
+    "typescript": "^6.0.3",
    "vitest": "4.1.10"
  },
  "dependencies": {
    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1101.0",
-    "@smithy/node-http-handler": "^4.9.13",
+    "@aws-sdk/client-sts": "^3.1080.0",
+    "@smithy/node-http-handler": "^4.9.1",
    "proxy-agent": "^8.0.2"
  },
  "keywords": [
@@ -2,7 +2,11 @@ import assert from 'node:assert';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
-import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
+import {
+  AssumeRoleCommand,
+  AssumeRoleWithWebIdentityCommand,
+  PackedPolicyTooLargeException,
+} from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
 import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';

@@ -61,7 +65,7 @@ async function assumeRoleWithCredentials(params: AssumeRoleCommandInput, client:
    const creds = await client.send(new AssumeRoleCommand({ ...params }));
    return creds;
  } catch (error) {
-    if ((error as { name?: string })?.name === 'PackedPolicyTooLargeException') {
+    if (error instanceof PackedPolicyTooLargeException) {
      core.info('Session tag size is too large; dropping droppable tags and retrying.');
      const droppableKeys = new Set(DROPPABLE_TAG_SOURCES.map((s) => s.key));
      params.Tags = params.Tags?.filter((tag) => !droppableKeys.has(tag.Key ?? ''));
@@ -3,6 +3,7 @@ import {
  AssumeRoleCommand,
  AssumeRoleWithWebIdentityCommand,
  GetCallerIdentityCommand,
+  PackedPolicyTooLargeException,
  STSClient,
 } from '@aws-sdk/client-sts';
 import { mockClient } from 'aws-sdk-client-mock';
@@ -330,11 +331,10 @@ describe('Configure AWS Credentials', {}, () => {
    });
    it('drops droppable tags and retries on PackedPolicyTooLargeException', {}, async () => {
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.IAM_ASSUMEROLE_INPUTS));
-      // Reject with a plain error carrying only the `name`, NOT an instance of the SDK class. This
-      // mirrors the bundled action, where the error can be deserialized by a second, non-identical
-      // copy of PackedPolicyTooLargeException so `instanceof` fails; the recovery must key off `name`.
-      const packedPolicyError = Object.assign(new Error('too large'), { name: 'PackedPolicyTooLargeException' });
-      mockedSTSClient.on(AssumeRoleCommand).rejectsOnce(packedPolicyError).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      mockedSTSClient
+        .on(AssumeRoleCommand)
+        .rejectsOnce(new PackedPolicyTooLargeException({ message: 'too large', $metadata: {} }))
+        .resolvesOnce(mocks.outputs.STS_CREDENTIALS);
      await run();
      expect(core.info).toHaveBeenCalledWith('Session tag size is too large; dropping droppable tags and retrying.');
      const retryInput = mockedSTSClient.commandCalls(AssumeRoleCommand)[1].args[0].input;