chore: run using node20

Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.36.1 to 0.38.0.
- [Release notes](https://github.com/vercel/ncc/releases)
- [Commits](https://github.com/vercel/ncc/compare/0.36.1...0.38.0)

---
updated-dependencies:
- dependency-name: "@vercel/ncc"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/close-stale-issues.yml

@@ -0,0 +1,51 @@
+name: "Close Stale Issues"
+
+# Controls when the action will run.
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: "0 */4 * * *"
+
+jobs:
+  cleanup:
+    permissions:
+      issues: write
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    name: Stale issue job
+    steps:
+    - uses: aws-actions/stale-issue-cleanup@v5
+      with:
+        # Setting messages to an empty string will cause the automation to skip
+        # that category
+        ancient-issue-message: This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
+        stale-issue-message: This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
+        stale-pr-message: This PR has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
+
+        # These labels are required
+        stale-issue-label: closing-soon
+        exempt-issue-labels: no-autoclose
+        stale-pr-label: closing-soon
+        exempt-pr-labels: no-autoclose
+        response-requested-label: response-requested
+
+        # Don't set closed-for-staleness label to skip closing very old issues
+        # regardless of label
+        closed-for-staleness-label: closed-for-staleness
+
+        # Issue timing
+        days-before-stale: 5
+        days-before-close: 2
+        days-before-ancient: 36500
+
+        # If you don't want to mark a issue as being ancient based on a
+        # threshold of "upvotes", you can set this here. An "upvote" is
+        # the total number of +1, heart, hooray, and rocket reactions
+        # on an issue.
+        minimum-upvotes-to-exempt: 5
+
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        loglevel: DEBUG
+        # Set dry-run to true to not perform label or close actions.
+        dry-run: false

.github/workflows/closed-issue-message.yml

@@ -13,7 +13,5 @@ jobs:
         # These inputs are both required
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         message: |
-          ** Note **
           Comments on closed issues are hard for our team to see.
           If you need more assistance, please either tag a team member or open a new issue that references this one.
-          If you wish to keep having a conversation with other community members under this issue feel free to do so.

.github/workflows/package.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths-ignore:
       - 'dist/**'
+  workflow_dispatch:
 
 jobs:
   package:
@@ -30,7 +31,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@v3
         with:
           aws-region: us-west-2
-          role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }}
+          role-to-assume: ${{ secrets.SECRETS_AWS_PACKAGING_ROLE_TO_ASSUME }}
           role-duration-seconds: 900
           role-session-name: SecretsManagerFetch
       - name: Get bot user token
@@ -38,7 +39,7 @@ jobs:
         with:
           parse-json-secrets: true
           secret-ids: |
-            OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
+            OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
       - name: Commit
         run: |
           echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"

.github/workflows/tests-integ.yml

@@ -1,4 +1,4 @@
-name: Run tests
+name: Run Integ tests
 
 on:
   workflow_dispatch:
@@ -27,6 +27,33 @@ jobs:
           role-duration-seconds: 900
           role-session-name: IntegOidcAssumeRole
           role-external-id: ${{ secrets.SECRETS_OIDC_AWS_ROLE_EXTERNAL_ID }}
+  integ-oidc-env:
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [[self-hosted, linux-fargate], windows-latest, ubuntu-latest, macos-latest]
+        node: [14, 16, 18]
+    name: Run OIDC integ tests with existing invalid env vars
+    runs-on: ${{ matrix.os }}
+    env:
+      AWS_ACCESS_KEY_ID: dummyaccesskeyid
+      AWS_SECRET_ACCESS_KEY: dummysecretkey
+      AWS_SESSION_TOKEN: dummytoken
+    timeout-minutes: 30
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v3
+      - name: Integ test for OIDC
+        uses: ./
+        with:
+          aws-region: us-west-2
+          role-to-assume: ${{ secrets.SECRETS_OIDC_AWS_ROLE_TO_ASSUME }}
+          role-duration-seconds: 900
+          role-session-name: IntegOidcAssumeRole
+          role-external-id: ${{ secrets.SECRETS_OIDC_AWS_ROLE_EXTERNAL_ID }}
   integ-access-keys:
     strategy:
       fail-fast: false

.mergify.yml

@@ -1,8 +1,18 @@
 queue_rules:
   - name: default
     conditions:
-      # Conditions to get out of the queue (= merged)
+      # Conditions to merge a queued PR
-      - status-success=Run Unit Tests
+      - check-success=Run unit tests (windows-latest, 14)
+      - check-success=Run unit tests (windows-latest, 16)
+      - check-success=Run unit tests (windows-latest, 18)
+      - check-success=Run unit tests (ubuntu-latest, 14)
+      - check-success=Run unit tests (ubuntu-latest, 16)
+      - check-success=Run unit tests (ubuntu-latest, 18)
+      - check-success=Run unit tests (macos-latest, 14)
+      - check-success=Run unit tests (macos-latest, 16)
+      - check-success=Run unit tests (macos-latest, 18)
+      - "#approved-reviews-by>=1"
+      - -approved-reviews-by~=author
 
 pull_request_rules:
   - name: Automatically merge on CI success and review approval
@@ -10,7 +20,15 @@ pull_request_rules:
       - base~=main|integ-tests
       - "#approved-reviews-by>=1"
       - -approved-reviews-by~=author
-      - status-success=Run Unit Tests
+      - check-success=Run unit tests (windows-latest, 14)
+      - check-success=Run unit tests (windows-latest, 16)
+      - check-success=Run unit tests (windows-latest, 18)
+      - check-success=Run unit tests (ubuntu-latest, 14)
+      - check-success=Run unit tests (ubuntu-latest, 16)
+      - check-success=Run unit tests (ubuntu-latest, 18)
+      - check-success=Run unit tests (macos-latest, 14)
+      - check-success=Run unit tests (macos-latest, 16)
+      - check-success=Run unit tests (macos-latest, 18)
       - label!=work-in-progress
       - -title~=(WIP|wip)
       - -merged
@@ -25,7 +43,15 @@ pull_request_rules:
     conditions:
       - base~=main
       - author=dependabot[bot]
-      - status-success=Run Unit Tests
+      - check-success=Run unit tests (windows-latest, 14)
+      - check-success=Run unit tests (windows-latest, 16)
+      - check-success=Run unit tests (windows-latest, 18)
+      - check-success=Run unit tests (ubuntu-latest, 14)
+      - check-success=Run unit tests (ubuntu-latest, 16)
+      - check-success=Run unit tests (ubuntu-latest, 18)
+      - check-success=Run unit tests (macos-latest, 14)
+      - check-success=Run unit tests (macos-latest, 16)
+      - check-success=Run unit tests (macos-latest, 18)
       - -title~=(WIP|wip)
       - -label~=(blocked|do-not-merge)
       - -merged

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [3.0.2](https://github.com/aws-actions/configure-aws-credentials/compare/v3.0.1...v3.0.2) (2023-09-07)
+
+### Bug Fixes
+* fixes #817 #819: validation logic throwing unwanted errors [d78f55b](https://github.com/aws-actions/configure-aws-credentials/commit/d78f55b1db65186cb251a8504ae9527af06fc5fd)
+
 ## [3.0.1](https://github.com/aws-actions/configure-aws-credentials/compare/v3.0.0...v3.0.1) (2023-08-24)
 
 ### Features

README.md

@@ -24,7 +24,7 @@ changes should be backwards compatible with your existing workflows.
 _all_ use cases. This is changed from 6 hours in `v2`. You can adjust this value
 with the `role-duration-seconds` input.
 - By default, your account ID will not be masked in workflow logs. This was
-changed from being masked by default in the previous version. AWS does consider
+changed from being masked by default in the previous version. AWS does not consider
 account IDs as sensitive information, so this change reflects that stance. You
 can revert to the old default and mask your account ID in workflow logs by
 setting the `mask-aws-account-id` input to `true`.
@@ -46,7 +46,7 @@ variables are interfering with the action. You can enable this by setting the
 **Bug fixes**
 
 You can find a list of bugs that have been fixed in v3 in the
-[changelog](./changelog.md).
+[changelog](./CHANGELOG.md).
 
 ---
 
@@ -291,7 +291,7 @@ We recommend using [GitHub's OIDC provider](https://docs.github.com/en/actions/d
 
 ### Audience
 
-When the JWT is created, an audience needs to be specified. By default, the audience is `sts.amazon.com` and this will work for most cases. Changing the default audience may be necessary when using non-default AWS partitions. You can specify the audience through the `audience` input:
+When the JWT is created, an audience needs to be specified. By default, the audience is `sts.amazonaws.com` and this will work for most cases. Changing the default audience may be necessary when using non-default AWS partitions. You can specify the audience through the `audience` input:
 
 ```yaml
     - name: Configure AWS Credentials for China region audience

action.yml

@@ -2,7 +2,7 @@
 name: '"Configure AWS Credentials" Action for GitHub Actions'
 description: Configures AWS credentials for use in subsequent steps in a GitHub Action workflow
 runs:
-  using: node16
+  using: node20
   main: dist/index.js
   post: dist/cleanup/index.js
 branding:

examples/federated-setup/README.md

@@ -1,6 +1,6 @@
 # federated-setup
 
-## [github-action-oidc-federation](./github-actions-odic-federation.yml)
+## [github-action-oidc-federation](./github-actions-oidc-federation.yml)
 
 Setup of the OIDC federation between your GitHub Organization/repository and your AWS account.
 

package.json

@@ -14,34 +14,34 @@
   },
   "devDependencies": {
     "@aws-sdk/credential-provider-env": "^3.186.0",
-    "@aws-sdk/property-provider": "^3.188.0",
+    "@smithy/property-provider": "^2.0.6",
-    "@jest/globals": "^29.1.2",
+    "@jest/globals": "^29.6.4",
-    "@types/jest": "^29.1.2",
+    "@types/jest": "^29.5.4",
-    "@types/node": "^14",
+    "@types/node": "^20",
-    "@typescript-eslint/eslint-plugin": "^5",
+    "@typescript-eslint/eslint-plugin": "<=5.62.0",
-    "@typescript-eslint/parser": "^5",
+    "@typescript-eslint/parser": "<=5.62.0",
-    "@vercel/ncc": "^0.34.0",
+    "@vercel/ncc": "^0.38.0",
-    "aws-sdk-client-mock": "^2.0.0",
+    "aws-sdk-client-mock": "^3.0.0",
     "copyfiles": "^2.4.1",
-    "del-cli": "^5.0.0",
+    "del-cli": "^5.1.0",
     "eslint": "^8",
-    "eslint-config-prettier": "^8.5.0",
+    "eslint-config-prettier": "^9.0.0",
     "eslint-import-resolver-node": "^0.3.6",
     "eslint-import-resolver-typescript": "^3.5.1",
-    "eslint-plugin-import": "^2.26.0",
+    "eslint-plugin-import": "^2.28.1",
-    "eslint-plugin-prettier": "^4.2.1",
+    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.1.2",
+    "jest": "^29.6.4",
-    "jest-junit": "^13",
+    "jest-junit": "^16",
     "json-schema": "^0.4.0",
-    "prettier": "^2.7.1",
+    "prettier": "^3.0.3",
     "standard-version": "^9",
     "ts-jest": "^29.0.3",
-    "typescript": "^4.8.4"
+    "typescript": "^5.2.2"
   },
   "dependencies": {
     "@actions/core": "^1.10.0",
     "@aws-sdk/client-sts": "^3",
-    "@aws-sdk/node-http-handler": "^3",
+    "@smithy/node-http-handler": "^2.0.0",
     "https-proxy-agent": "^5.0.0"
   },
   "keywords": [

src/CredentialsClient.ts

@@ -1,6 +1,6 @@
 import { info } from '@actions/core';
 import { STSClient } from '@aws-sdk/client-sts';
-import { NodeHttpHandler } from '@aws-sdk/node-http-handler';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { errorMessage } from './helpers';
 

src/index.ts

@@ -128,15 +128,13 @@ export async function run() {
       // the source credentials to already be masked as secrets
       // in any error messages.
       exportCredentials({ AccessKeyId, SecretAccessKey, SessionToken });
-    } else if (
+    } else if (!webIdentityTokenFile && !roleChaining) {
-      !webIdentityTokenFile &&
+      // Proceed only if credentials can be picked up
-      !roleChaining &&
+      await credentialsClient.validateCredentials();
-      !(process.env['AWS_ACCESS_KEY_ID'] && process.env['AWS_SECRET_ACCESS_KEY'])
+      sourceAccountId = await exportAccountId(credentialsClient, maskAccountId);
-    ) {
-      throw new Error('Could not determine how to assume credentials. Please check your inputs and try again.');
     }
 
-    if (AccessKeyId || roleChaining || (process.env['AWS_ACCESS_KEY_ID'] && process.env['AWS_SECRET_ACCESS_KEY'])) {
+    if (AccessKeyId || roleChaining) {
       // Validate that the SDK can actually pick up credentials.
       // This validates cases where this action is using existing environment credentials,
       // and cases where the user intended to provide input credentials but the secrets inputs resolved to empty strings.

test/index.test.ts

@@ -6,7 +6,7 @@ import {
   STSClient,
 } from '@aws-sdk/client-sts';
 import { fromEnv } from '@aws-sdk/credential-provider-env';
-import { CredentialsProviderError } from '@aws-sdk/property-provider';
+import { CredentialsProviderError } from '@smithy/property-provider';
 import { mockClient } from 'aws-sdk-client-mock';
 import { withsleep, reset } from '../src/helpers';
 import { run } from '../src/index';
@@ -202,7 +202,7 @@ describe('Configure AWS Credentials', () => {
     await run();
 
     expect(core.setFailed).toHaveBeenCalledWith(
-      'Could not determine how to assume credentials. Please check your inputs and try again.'
+      'Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers'
     );
   });
 
@@ -217,7 +217,7 @@ describe('Configure AWS Credentials', () => {
     await run();
 
     expect(core.setFailed).toHaveBeenCalledWith(
-      'Could not determine how to assume credentials. Please check your inputs and try again.'
+      'Credentials could not be loaded, please check your action inputs: Access key ID empty after loading credentials'
     );
   });
 
@@ -508,6 +508,8 @@ describe('Configure AWS Credentials', () => {
   });
 
   test('GH OIDC check fails if token is not set', async () => {
+    (fromEnv as jest.Mock).mockReset();
+    process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] = undefined;
     process.env['GITHUB_ACTIONS'] = 'true';
     jest.spyOn(core, 'getInput').mockImplementation(
       mockGetInput({
@@ -523,11 +525,12 @@ describe('Configure AWS Credentials', () => {
         ' If you are not trying to authenticate with OIDC and the action is working successfully, you can ignore this message.'
     );
     expect(core.setFailed).toHaveBeenCalledWith(
-      'Could not determine how to assume credentials. Please check your inputs and try again.'
+      'Credentials could not be loaded, please check your action inputs: provider is not a function'
     );
   });
 
   test('Assume role with existing credentials if nothing else set', async () => {
+    process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] = undefined;
     process.env['AWS_ACCESS_KEY_ID'] = FAKE_ACCESS_KEY_ID;
     process.env['AWS_SECRET_ACCESS_KEY'] = FAKE_SECRET_ACCESS_KEY;
     jest.spyOn(core, 'getInput').mockImplementation(