chore(release): 1.6.1

fix: OIDC Parallel Requests error

.mergify.yml

@@ -1,3 +1,10 @@
+queue_rules:
+  - name: default
+    conditions:
+      # Conditions to get out of the queue (= merged)
+      - status-success=Run Unit Tests
+      - status-success=Semantic Pull Request
+
 pull_request_rules:
   - name: Automatically merge on CI success and review approval
     conditions:
@@ -13,10 +20,9 @@ pull_request_rules:
       - -closed
       - author!=dependabot[bot]
     actions:
-      merge:
+      queue:
         method: squash
-        strict: smart
-        strict_method: merge
+        name: default
 
   - name: Automatically approve and merge Dependabot PRs
     conditions:
@@ -31,7 +37,6 @@ pull_request_rules:
     actions:
       review:
         type: APPROVE
-      merge:
+      queue:
         method: squash
-        strict: smart+fasttrack
-        strict_method: merge
+        name: default

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [1.6.1](https://github.com/aws-actions/configure-aws-credentials/compare/v1.6.0...v1.6.1) (2022-01-18)
+
+
+### Bug Fixes
+
+* OIDC Parallel Requests error ([133757e](https://github.com/aws-actions/configure-aws-credentials/commit/133757e9b829f4ef44c8e99e3f272879b45fc9c5))
+* Strict Mode Deprecation ([4c5e1c6](https://github.com/aws-actions/configure-aws-credentials/commit/4c5e1c60ccfc95d0e48bf1bc95fc707a94aa2c60))
+
 ## [1.6.0](https://github.com/aws-actions/configure-aws-credentials/compare/v1.5.11...v1.6.0) (2021-11-23)
 
 

index.js

@@ -236,6 +236,29 @@ function getStsClient(region) {
   });
 }
 
+let defaultSleep = function (ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+};
+let sleep = defaultSleep;
+
+// retryAndBackoff retries with exponential backoff the promise if the error isRetryable upto maxRetries time.
+const retryAndBackoff = async (fn, isRetryable, retries = 0, maxRetries = 12, base = 50) => {
+  try {
+    return await fn();
+  } catch (err) {
+    if (!isRetryable) {
+      throw err;
+    }
+    // It's retryable, so sleep and retry.
+    await sleep(Math.random() * (Math.pow(2, retries) * base) );
+    retries += 1;
+    if (retries === maxRetries) {
+      throw err;
+    }
+    return await retryAndBackoff(fn, isRetryable, retries, maxRetries, base);
+  }
+}
+
 async function run() {
   try {
     // Get inputs
@@ -303,17 +326,18 @@ async function run() {
 
     // Get role credentials if configured to do so
     if (roleToAssume) {
-      const roleCredentials = await assumeRole({
-        sourceAccountId,
-        region,
-        roleToAssume,
-        roleExternalId,
-        roleDurationSeconds,
-        roleSessionName,
-        roleSkipSessionTagging,
-        webIdentityTokenFile,
-        webIdentityToken
-      });
+      const roleCredentials = await retryAndBackoff(
+          async () => { return await assumeRole({
+            sourceAccountId,
+            region,
+            roleToAssume,
+            roleExternalId,
+            roleDurationSeconds,
+            roleSessionName,
+            roleSkipSessionTagging,
+            webIdentityTokenFile,
+            webIdentityToken
+          }) }, true);
       exportCredentials(roleCredentials);
       // We need to validate the credentials in 2 of our use-cases
       // First: self-hosted runners. If the GITHUB_ACTIONS environment variable
@@ -337,7 +361,14 @@ async function run() {
   }
 }
 
-module.exports = run;
+exports.withSleep = function (s) {
+  sleep = s;
+};
+exports.reset = function () {
+  sleep = defaultSleep;
+};
+
+exports.run = run
 
 /* istanbul ignore next */
 if (require.main === module) {

index.test.js

@@ -1,7 +1,7 @@
 const core = require('@actions/core');
 const assert = require('assert');
 const aws = require('aws-sdk');
-const run = require('./index.js');
+const { run, withSleep, reset }  = require('./index.js');
 
 jest.mock('@actions/core');
 
@@ -156,10 +156,15 @@ describe('Configure AWS Credentials', () => {
                 }
             }
         });
+
+        withSleep(() => {
+            return Promise.resolve();
+        });
     });
 
     afterEach(() => {
         process.env = OLD_ENV;
+        reset();
     });
 
     test('exports env vars', async () => {
@@ -612,6 +617,23 @@ describe('Configure AWS Credentials', () => {
         expect(core.setSecret).toHaveBeenNthCalledWith(3, FAKE_STS_SESSION_TOKEN);
     });
 
+    test('role assumption fails after maximun trials using OIDC Provider', async () => {
+        process.env.GITHUB_ACTIONS = 'true';
+        process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'test-token';
+
+        core.getInput = jest
+            .fn()
+            .mockImplementation(mockGetInput({'role-to-assume': ROLE_ARN, 'aws-region': FAKE_REGION}));
+
+        mockStsAssumeRoleWithWebIdentity.mockReset();
+        mockStsAssumeRoleWithWebIdentity.mockImplementation(() => {
+            throw new Error();
+        });
+
+        await assert.rejects(() => run());
+        expect(mockStsAssumeRoleWithWebIdentity).toHaveBeenCalledTimes(12)
+    });
+
     test('role external ID provided', async () => {
         core.getInput = jest
             .fn()

package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-actions-configure-aws-credentials",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Configure AWS Credentials",
   "main": "index.js",
   "scripts": {
@@ -26,12 +26,12 @@
   "homepage": "https://github.com/aws-actions/configure-aws-credentials#readme",
   "dependencies": {
     "@actions/core": "^1.6.0",
-    "aws-sdk": "^2.1034.0",
+    "aws-sdk": "^2.1058.0",
     "axios": "^0.24.0"
   },
   "devDependencies": {
     "@zeit/ncc": "^0.22.3",
-    "eslint": "^8.3.0",
-    "jest": "^27.3.1"
+    "eslint": "^8.7.0",
+    "jest": "^27.4.7"
   }
 }