feat: refresh OIDC token if expiring

chore(docs): fix automated readme version bumping (#1850 )
chore(main): release 6.2.1 (#1849 )
2026-08-25 04:35:06 +09:00 · 2026-06-26 15:09:12 -07:00 · 2026-06-26 14:54:03 -07:00 · 2026-06-26 14:23:45 -07:00 · 2026-06-26 20:42:54 +00:00 · 2026-06-26 13:33:19 -07:00
15 changed files with 4321 additions and 5063 deletions
@@ -48,6 +48,7 @@
          uses: actions/checkout@v5
          with:
            fetch-depth: 0
+            persist-credentials: false

        - name: Tag Major Version
          if: ${{ steps.release.outputs.release_created }}
@@ -1,5 +1,5 @@
 {
  ".release-please-manifest.json": "4.0.2",
  "package.json": "6.0.0",
-  ".": "6.2.0"
+  ".": "6.2.1"
 }
@@ -2,6 +2,13 @@

 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

+## [6.2.1](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.0...v6.2.1) (2026-06-26)
+
+
+### Bug Fixes
+
+* enforce allowed-account-ids on all auth paths ([#1847](https://github.com/aws-actions/configure-aws-credentials/issues/1847)) ([4d281fb](https://github.com/aws-actions/configure-aws-credentials/commit/4d281fbc56a82e63c3fc14f2cc22361f34c97493))
+
 ## [6.2.0](https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.3...v6.2.0) (2026-06-01)

 ### Features
@@ -776,7 +776,10 @@ the environment (for example, on a self-hosted runner where you do not want the
 assumed-role credentials to shadow an existing EC2 instance profile), pair
 `output-credentials: true` with `output-env-credentials: false`. In that mode,
 the action does not run its post-credential SDK-pickup validation step, since
-the credentials were never written to the environment.
+the credentials were never written to the environment. The action still
+validates the resolved credentials by calling `sts:GetCallerIdentity` with the
+explicit credentials, so the `allowed-account-ids` check can be enforced if
+provided.

 ### Configure multiple AWS profiles in a single workflow

@@ -644,7 +644,7 @@ Apache License

 The following npm package may be included in this product:

- - @aws-sdk/client-sts@3.1049.0
+ - @aws-sdk/client-sts@3.1075.0

 This package contains the following license:

@@ -854,9 +854,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/signature-v4-multi-region@3.996.27
- - @smithy/core@3.24.5
- - @smithy/types@4.14.2
+ - @aws-sdk/signature-v4-multi-region@3.996.35
+ - @smithy/core@3.26.0
+ - @smithy/types@4.15.0

 These packages each contain the following license:

@@ -1068,10 +1068,10 @@ The following npm packages may be included in this product:

 - agent-base@9.0.0
 - degenerator@7.0.1
- - https-proxy-agent@9.0.0
+ - https-proxy-agent@9.1.0
 - pac-resolver@9.0.1
- - proxy-agent@8.0.1
- - socks-proxy-agent@10.0.0
+ - proxy-agent@8.0.2
+ - socks-proxy-agent@10.1.0

 These packages each contain the following license:

@@ -1102,7 +1102,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 The following npm package may be included in this product:

- - http-proxy-agent@9.0.0
+ - http-proxy-agent@9.1.0

 This package contains the following license:

@@ -1134,7 +1134,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 The following npm packages may be included in this product:

 - data-uri-to-buffer@8.0.0
- - get-uri@8.0.0
+ - get-uri@8.0.1

 These packages each contain the following license:

@@ -1165,7 +1165,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 The following npm package may be included in this product:

- - pac-proxy-agent@9.0.1
+ - pac-proxy-agent@9.1.0

 This package contains the following license:

@@ -1254,7 +1254,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 The following npm package may be included in this product:

- - @aws-sdk/core@3.974.15
+ - @aws-sdk/core@3.974.23

 This package contains the following license:

@@ -1674,18 +1674,18 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-env@3.972.41
- - @aws-sdk/credential-provider-ini@3.972.42
- - @aws-sdk/credential-provider-node@3.972.43
- - @aws-sdk/token-providers@3.1049.0
- - @aws-sdk/types@3.973.9
- - @aws-sdk/util-locate-window@3.965.5
- - @aws-sdk/xml-builder@3.972.26
- - @smithy/credential-provider-imds@4.3.3
- - @smithy/fetch-http-handler@5.4.3
+ - @aws-sdk/credential-provider-env@3.972.49
+ - @aws-sdk/credential-provider-ini@3.972.56
+ - @aws-sdk/credential-provider-node@3.972.58
+ - @aws-sdk/token-providers@3.1074.0
+ - @aws-sdk/types@3.973.13
+ - @aws-sdk/util-locate-window@3.965.8
+ - @aws-sdk/xml-builder@3.972.31
+ - @smithy/credential-provider-imds@4.4.2
+ - @smithy/fetch-http-handler@5.5.2
 - @smithy/is-array-buffer@2.2.0
- - @smithy/node-http-handler@4.7.3
- - @smithy/signature-v4@5.4.5
+ - @smithy/node-http-handler@4.8.2
+ - @smithy/signature-v4@5.4.6
 - @smithy/util-buffer-from@2.2.0
 - @smithy/util-utf8@2.3.0

@@ -1897,9 +1897,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-process@3.972.38
- - @aws-sdk/credential-provider-sso@3.972.42
- - @aws-sdk/credential-provider-web-identity@3.972.42
+ - @aws-sdk/credential-provider-process@3.972.49
+ - @aws-sdk/credential-provider-sso@3.972.55
+ - @aws-sdk/credential-provider-web-identity@3.972.55

 These packages each contain the following license:

@@ -2109,9 +2109,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-http@3.972.40
- - @aws-sdk/credential-provider-login@3.972.42
- - @aws-sdk/nested-clients@3.997.10
+ - @aws-sdk/credential-provider-http@3.972.51
+ - @aws-sdk/credential-provider-login@3.972.55
+ - @aws-sdk/nested-clients@3.997.23

 These packages each contain the following license:

@@ -2335,9 +2335,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 The following npm packages may be included in this product:

- - @nodable/entities@2.1.1
+ - proxy-agent-negotiate@1.1.0
 - quickjs-wasi@2.2.0
- - xml-naming@0.1.0

 These packages each contain the following license:

@@ -2377,127 +2376,7 @@ SOFTWARE.

 The following npm package may be included in this product:

- - fast-xml-parser@5.7.3
-
-This package contains the following license:
-
-MIT License
-
-Copyright (c) 2017 Amit Kumar Gupta
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-----------
-
-The following npm package may be included in this product:
-
- - strnum@2.3.0
-
-This package contains the following license:
-
-MIT License
-
-Copyright (c) 2021 Natural Intelligence
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-----------
-
-The following npm package may be included in this product:
-
- - path-expression-matcher@1.5.0
-
-This package contains the following license:
-
-MIT License
-
-Copyright (c) 2024
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-----------
-
-The following npm package may be included in this product:
-
- - fast-xml-builder@1.2.0
-
-This package contains the following license:
-
-MIT License
-
-Copyright (c) 2026 Natural Intelligence
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-----------
-
-The following npm package may be included in this product:
-
- - undici@6.25.0
+ - undici@6.27.0

 This package contains the following license:

@@ -6,7 +6,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
  for (var name in all)
@@ -2058,6 +2062,7 @@ var require_dispatcher_base = __commonJS({
      }
      get webSocketOptions() {
        return {
+          maxFragments: this[kWebSocketOptions].maxFragments ?? 131072,
          maxPayloadSize: this[kWebSocketOptions].maxPayloadSize ?? 128 * 1024 * 1024
        };
      }
@@ -5712,6 +5717,9 @@ var require_client_h1 = __commonJS({
    var FastBuffer = Buffer[Symbol.species];
    var addListener = util.addListener;
    var removeAllListeners = util.removeAllListeners;
+    var kIdleSocketValidation = /* @__PURE__ */ Symbol("kIdleSocketValidation");
+    var kIdleSocketValidationTimeout = /* @__PURE__ */ Symbol("kIdleSocketValidationTimeout");
+    var kSocketUsed = /* @__PURE__ */ Symbol("kSocketUsed");
    var extractBody;
    async function lazyllhttp() {
      const llhttpWasmData = process.env.JEST_WORKER_ID ? require_llhttp_wasm() : void 0;
@@ -5874,24 +5882,55 @@ var require_client_h1 = __commonJS({
            currentBufferRef = null;
          }
          const offset = llhttp.llhttp_get_error_pos(this.ptr) - currentBufferPtr;
-          if (ret === constants4.ERROR.PAUSED_UPGRADE) {
-            this.onUpgrade(data.slice(offset));
-          } else if (ret === constants4.ERROR.PAUSED) {
-            this.paused = true;
-            socket.unshift(data.slice(offset));
-          } else if (ret !== constants4.ERROR.OK) {
-            const ptr = llhttp.llhttp_get_error_reason(this.ptr);
-            let message = "";
-            if (ptr) {
-              const len = new Uint8Array(llhttp.memory.buffer, ptr).indexOf(0);
-              message = "Response does not match the HTTP/1.1 protocol (" + Buffer.from(llhttp.memory.buffer, ptr, len).toString() + ")";
+          if (ret !== constants4.ERROR.OK) {
+            const body = data.subarray(offset);
+            if (ret === constants4.ERROR.PAUSED_UPGRADE) {
+              this.onUpgrade(body);
+            } else if (ret === constants4.ERROR.PAUSED) {
+              this.paused = true;
+              socket.unshift(body);
+            } else {
+              throw this.createError(ret, body);
            }
-            throw new HTTPParserError(message, constants4.ERROR[ret], data.slice(offset));
          }
        } catch (err) {
          util.destroy(socket, err);
        }
      }
+      finish() {
+        assert(currentParser === null);
+        assert(this.ptr != null);
+        assert(!this.paused);
+        const { llhttp } = this;
+        let ret;
+        try {
+          currentParser = this;
+          ret = llhttp.llhttp_finish(this.ptr);
+        } finally {
+          currentParser = null;
+        }
+        if (ret === constants4.ERROR.OK) {
+          return null;
+        }
+        if (ret === constants4.ERROR.PAUSED || ret === constants4.ERROR.PAUSED_UPGRADE) {
+          this.paused = true;
+          return null;
+        }
+        return this.createError(ret, EMPTY_BUF);
+      }
+      createError(ret, data) {
+        const { llhttp, contentLength, bytesRead } = this;
+        if (contentLength && bytesRead !== parseInt(contentLength, 10)) {
+          return new ResponseContentLengthMismatchError();
+        }
+        const ptr = llhttp.llhttp_get_error_reason(this.ptr);
+        let message = "";
+        if (ptr) {
+          const len = new Uint8Array(llhttp.memory.buffer, ptr).indexOf(0);
+          message = "Response does not match the HTTP/1.1 protocol (" + Buffer.from(llhttp.memory.buffer, ptr, len).toString() + ")";
+        }
+        return new HTTPParserError(message, constants4.ERROR[ret], data);
+      }
      destroy() {
        assert(this.ptr != null);
        assert(currentParser == null);
@@ -5911,6 +5950,10 @@ var require_client_h1 = __commonJS({
        if (socket.destroyed) {
          return -1;
        }
+        if (client[kRunning] === 0) {
+          util.destroy(socket, new SocketError("bad response", util.getSocketInfo(socket)));
+          return -1;
+        }
        const request = client[kQueue][client[kRunningIdx]];
        if (!request) {
          return -1;
@@ -5990,6 +6033,10 @@ var require_client_h1 = __commonJS({
        if (socket.destroyed) {
          return -1;
        }
+        if (client[kRunning] === 0) {
+          util.destroy(socket, new SocketError("bad response", util.getSocketInfo(socket)));
+          return -1;
+        }
        const request = client[kQueue][client[kRunningIdx]];
        if (!request) {
          return -1;
@@ -6115,6 +6162,7 @@ var require_client_h1 = __commonJS({
        }
        request.onComplete(headers);
        client[kQueue][client[kRunningIdx]++] = null;
+        socket[kSocketUsed] = true;
        if (socket[kWriting]) {
          assert(client[kRunning] === 0);
          util.destroy(socket, new InformationalError("reset"));
@@ -6158,12 +6206,19 @@ var require_client_h1 = __commonJS({
      socket[kWriting] = false;
      socket[kReset] = false;
      socket[kBlocking] = false;
+      socket[kIdleSocketValidation] = 0;
+      socket[kIdleSocketValidationTimeout] = null;
+      socket[kSocketUsed] = false;
      socket[kParser] = new Parser(client, socket, llhttpInstance);
      addListener(socket, "error", function(err) {
        assert(err.code !== "ERR_TLS_CERT_ALTNAME_INVALID");
        const parser = this[kParser];
        if (err.code === "ECONNRESET" && parser.statusCode && !parser.shouldKeepAlive) {
-          parser.onMessageComplete();
+          const parserErr = parser.finish();
+          if (parserErr) {
+            this[kError] = parserErr;
+            this[kClient][kOnError](parserErr);
+          }
          return;
        }
        this[kError] = err;
@@ -6178,7 +6233,10 @@ var require_client_h1 = __commonJS({
      addListener(socket, "end", function() {
        const parser = this[kParser];
        if (parser.statusCode && !parser.shouldKeepAlive) {
-          parser.onMessageComplete();
+          const parserErr = parser.finish();
+          if (parserErr) {
+            util.destroy(this, parserErr);
+          }
          return;
        }
        util.destroy(this, new SocketError("other side closed", util.getSocketInfo(this)));
@@ -6186,9 +6244,10 @@ var require_client_h1 = __commonJS({
      addListener(socket, "close", function() {
        const client2 = this[kClient];
        const parser = this[kParser];
+        clearIdleSocketValidation(this);
        if (parser) {
          if (!this[kError] && parser.statusCode && !parser.shouldKeepAlive) {
-            parser.onMessageComplete();
+            this[kError] = parser.finish() || this[kError];
          }
          this[kParser].destroy();
          this[kParser] = null;
@@ -6237,7 +6296,7 @@ var require_client_h1 = __commonJS({
          return socket.destroyed;
        },
        busy(request) {
-          if (socket[kWriting] || socket[kReset] || socket[kBlocking]) {
+          if (socket[kWriting] || socket[kReset] || socket[kBlocking] || socket[kIdleSocketValidation] === 1) {
            return true;
          }
          if (request) {
@@ -6255,6 +6314,24 @@ var require_client_h1 = __commonJS({
        }
      };
    }
+    function clearIdleSocketValidation(socket) {
+      if (socket[kIdleSocketValidationTimeout]) {
+        clearTimeout(socket[kIdleSocketValidationTimeout]);
+        socket[kIdleSocketValidationTimeout] = null;
+      }
+      socket[kIdleSocketValidation] = 0;
+    }
+    function scheduleIdleSocketValidation(client, socket) {
+      socket[kIdleSocketValidation] = 1;
+      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+        socket[kIdleSocketValidationTimeout] = null;
+        socket[kIdleSocketValidation] = 2;
+        if (client[kSocket] === socket && !socket.destroyed) {
+          client[kResume]();
+        }
+      }, 0);
+      socket[kIdleSocketValidationTimeout].unref?.();
+    }
    function resumeH1(client) {
      const socket = client[kSocket];
      if (socket && !socket.destroyed) {
@@ -6267,6 +6344,29 @@ var require_client_h1 = __commonJS({
          socket.ref();
          socket[kNoRef] = false;
        }
+        if (client[kRunning] === 0 && client[kPending] > 0 && socket[kSocketUsed]) {
+          if (socket[kIdleSocketValidation] === 0) {
+            scheduleIdleSocketValidation(client, socket);
+            socket[kParser].readMore();
+            if (socket.destroyed) {
+              return;
+            }
+            return;
+          }
+          if (socket[kIdleSocketValidation] === 1) {
+            socket[kParser].readMore();
+            if (socket.destroyed) {
+              return;
+            }
+            return;
+          }
+        }
+        if (client[kRunning] === 0) {
+          socket[kParser].readMore();
+          if (socket.destroyed) {
+            return;
+          }
+        }
        if (client[kSize] === 0) {
          if (socket[kParser].timeoutType !== TIMEOUT_KEEP_ALIVE) {
            socket[kParser].setTimeout(client[kKeepAliveTimeoutValue], TIMEOUT_KEEP_ALIVE);
@@ -6319,6 +6419,7 @@ var require_client_h1 = __commonJS({
        process.emitWarning(new RequestContentLengthMismatchError());
      }
      const socket = client[kSocket];
+      clearIdleSocketValidation(socket);
      const abort = (err) => {
        if (request.aborted || request.completed) {
          return;
@@ -16103,18 +16204,14 @@ var require_parse = __commonJS({
      } else if (attributeNameLowercase === "httponly") {
        cookieAttributeList.httpOnly = true;
      } else if (attributeNameLowercase === "samesite") {
-        let enforcement = "Default";
        const attributeValueLowercase = attributeValue.toLowerCase();
-        if (attributeValueLowercase.includes("none")) {
-          enforcement = "None";
+        if (attributeValueLowercase === "none") {
+          cookieAttributeList.sameSite = "None";
+        } else if (attributeValueLowercase === "strict") {
+          cookieAttributeList.sameSite = "Strict";
+        } else if (attributeValueLowercase === "lax") {
+          cookieAttributeList.sameSite = "Lax";
        }
-        if (attributeValueLowercase.includes("strict")) {
-          enforcement = "Strict";
-        }
-        if (attributeValueLowercase.includes("lax")) {
-          enforcement = "Lax";
-        }
-        cookieAttributeList.sameSite = enforcement;
      } else {
        cookieAttributeList.unparsed ??= [];
        cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`);
@@ -17136,6 +17233,10 @@ var require_receiver = __commonJS({
    var { closeWebSocketConnection } = require_connection();
    var { PerMessageDeflate } = require_permessage_deflate();
    var { MessageSizeExceededError } = require_errors();
+    function failWebsocketConnectionWithCode(ws, code, reason) {
+      closeWebSocketConnection(ws, code, reason, Buffer.byteLength(reason));
+      failWebsocketConnection(ws, reason);
+    }
    var ByteParser = class extends Writable {
      #buffers = [];
      #fragmentsBytes = 0;
@@ -17147,16 +17248,19 @@ var require_receiver = __commonJS({
      /** @type {Map<string, PerMessageDeflate>} */
      #extensions;
      /** @type {number} */
+      #maxFragments;
+      /** @type {number} */
      #maxPayloadSize;
      /**
       * @param {import('./websocket').WebSocket} ws
       * @param {Map<string, string>|null} extensions
-       * @param {{ maxPayloadSize?: number }} [options]
+       * @param {{ maxFragments?: number, maxPayloadSize?: number }} [options]
       */
      constructor(ws, extensions, options = {}) {
        super();
        this.ws = ws;
        this.#extensions = extensions == null ? /* @__PURE__ */ new Map() : extensions;
+        this.#maxFragments = options.maxFragments ?? 0;
        this.#maxPayloadSize = options.maxPayloadSize ?? 0;
        if (this.#extensions.has("permessage-deflate")) {
          this.#extensions.set("permessage-deflate", new PerMessageDeflate(extensions, options));
@@ -17173,8 +17277,8 @@ var require_receiver = __commonJS({
        this.run(callback);
      }
      #validatePayloadLength() {
-        if (this.#maxPayloadSize > 0 && !isControlFrame(this.#info.opcode) && this.#info.payloadLength > this.#maxPayloadSize) {
-          failWebsocketConnection(this.ws, "Payload size exceeds maximum allowed size");
+        if (this.#maxPayloadSize > 0 && !isControlFrame(this.#info.opcode) && this.#info.payloadLength + this.#fragmentsBytes > this.#maxPayloadSize) {
+          failWebsocketConnectionWithCode(this.ws, 1009, "Payload size exceeds maximum allowed size");
          return false;
        }
        return true;
@@ -17290,9 +17394,11 @@ var require_receiver = __commonJS({
              this.#state = parserStates.INFO;
            } else {
              if (!this.#info.compressed) {
-                this.writeFragments(body);
+                if (!this.writeFragments(body)) {
+                  return;
+                }
                if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) {
-                  failWebsocketConnection(this.ws, new MessageSizeExceededError().message);
+                  failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message);
                  return;
                }
                if (!this.#info.fragmented && this.#info.fin) {
@@ -17305,12 +17411,15 @@ var require_receiver = __commonJS({
                  this.#info.fin,
                  (error2, data) => {
                    if (error2) {
-                      failWebsocketConnection(this.ws, error2.message);
+                      const code = error2 instanceof MessageSizeExceededError ? 1009 : 1007;
+                      failWebsocketConnectionWithCode(this.ws, code, error2.message);
+                      return;
+                    }
+                    if (!this.writeFragments(data)) {
                      return;
                    }
-                    this.writeFragments(data);
                    if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) {
-                      failWebsocketConnection(this.ws, new MessageSizeExceededError().message);
+                      failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message);
                      return;
                    }
                    if (!this.#info.fin) {
@@ -17368,8 +17477,13 @@ var require_receiver = __commonJS({
        return buffer;
      }
      writeFragments(fragment) {
+        if (this.#maxFragments > 0 && this.#fragments.length === this.#maxFragments) {
+          failWebsocketConnectionWithCode(this.ws, 1008, "Too many message fragments");
+          return false;
+        }
        this.#fragmentsBytes += fragment.length;
        this.#fragments.push(fragment);
+        return true;
      }
      consumeFragments() {
        const fragments = this.#fragments;
@@ -17819,8 +17933,11 @@ var require_websocket = __commonJS({
       */
      #onConnectionEstablished(response, parsedExtensions) {
        this[kResponse] = response;
-        const maxPayloadSize = this[kController]?.dispatcher?.webSocketOptions?.maxPayloadSize;
+        const webSocketOptions = this[kController]?.dispatcher?.webSocketOptions;
+        const maxFragments = webSocketOptions?.maxFragments;
+        const maxPayloadSize = webSocketOptions?.maxPayloadSize;
        const parser = new ByteParser(this, parsedExtensions, {
+          maxFragments,
          maxPayloadSize
        });
        parser.on("drain", onParserDrain);
@@ -1,7 +1,7 @@
 {
  "name": "configure-aws-credentials",
  "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.0",
+  "version": "6.2.1",
  "scripts": {
    "build": "tsc",
    "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,26 +17,26 @@
    "organization": true
  },
  "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.39",
-    "@biomejs/biome": "2.4.15",
-    "@smithy/property-provider": "^4.3.4",
-    "@types/node": "^25.9.1",
-    "@vitest/coverage-v8": "4.1.5",
+    "@aws-sdk/credential-provider-env": "^3.972.49",
+    "@biomejs/biome": "2.5.0",
+    "@smithy/property-provider": "^4.4.2",
+    "@types/node": "^26.0.0",
+    "@vitest/coverage-v8": "4.1.9",
    "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "^0.28.0",
-    "generate-license-file": "^4.1.1",
+    "esbuild": "^0.28.1",
+    "generate-license-file": "^4.2.1",
    "json-schema": "^0.4.0",
-    "markdownlint-cli": "^0.48.0",
-    "memfs": "^4.57.2",
+    "markdownlint-cli": "^0.49.0",
+    "memfs": "^4.57.8",
    "standard-version": "^9.5.0",
    "typescript": "^6.0.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.9"
  },
  "dependencies": {
    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1049.0",
-    "@smithy/node-http-handler": "^4.7.3",
-    "proxy-agent": "^8.0.1"
+    "@aws-sdk/client-sts": "^3.1075.0",
+    "@smithy/node-http-handler": "^4.8.2",
+    "proxy-agent": "^8.0.2"
  },
  "keywords": [
    "aws",
@@ -10,6 +10,10 @@ if (!process.env.AWS_EXECUTION_ENV) {
  process.env.AWS_EXECUTION_ENV = 'GitHubActions';
 }

+// Bound how long a single STS call may hang. 60s per attempt keeps the total
+// failure time predictable.
+const STS_TIMEOUT_MS = 60_000;
+
 export interface CredentialsClientProps {
  region?: string;
  proxyServer?: string;
@@ -43,6 +47,14 @@ export class CredentialsClient {
      this.requestHandler = new NodeHttpHandler({
        httpsAgent: handler,
        httpAgent: handler,
+        connectionTimeout: STS_TIMEOUT_MS,
+        requestTimeout: STS_TIMEOUT_MS,
+      });
+    } else {
+      // No proxy
+      this.requestHandler = new NodeHttpHandler({
+        connectionTimeout: STS_TIMEOUT_MS,
+        requestTimeout: STS_TIMEOUT_MS,
      });
    }
    if (props.stsEndpoint) {
@@ -53,54 +65,55 @@ export class CredentialsClient {

  public get stsClient(): STSClient {
    if (!this._stsClient || this.roleChaining) {
-      this._stsClient = new STSClient({
-        customUserAgent: buildCustomUserAgent(),
-        ...(this.region !== undefined && { region: this.region }),
-        ...(this.stsEndpoint !== undefined && { endpoint: this.stsEndpoint }),
-        ...(this.requestHandler !== undefined && { requestHandler: this.requestHandler }),
-      });
+      this._stsClient = this.createStsClient();
    }
    return this._stsClient;
  }

+  // Builds an STS client using the action's configured region/endpoint/proxy. When explicit credentials are provided,
+  // the client uses them directly instead of the SDK default credential provider chain.
+  // This matters for validateAccountId.
+  private createStsClient(credentials?: AwsCredentialIdentity): STSClient {
+    return new STSClient({
+      customUserAgent: buildCustomUserAgent(),
+      ...(this.region !== undefined && { region: this.region }),
+      ...(this.stsEndpoint !== undefined && { endpoint: this.stsEndpoint }),
+      ...(this.requestHandler !== undefined && { requestHandler: this.requestHandler }),
+      ...(credentials !== undefined && { credentials }),
+    });
+  }
+
+  // Validates that the credentials the action will hand to subsequent steps actually work, and returns the resolved
+  // caller identity (account + ARN). "Work" is proven by a sts:GetCallerIdentity call, which both confirms the
+  // credentials are accepted by AWS and returns the identity for later checks and outputs to use.
  public async validateCredentials(
+    credentials?: AwsCredentialIdentity,
    expectedAccessKeyId?: string,
    roleChaining?: boolean,
-    expectedAccountIds?: string[],
-  ) {
-    let credentials: AwsCredentialIdentity;
-    try {
-      credentials = await this.loadCredentials();
-      if (!credentials.accessKeyId) {
-        throw new Error('Access key ID empty after loading credentials');
-      }
-    } catch (error) {
-      throw new Error(`Credentials could not be loaded, please check your action inputs: ${errorMessage(error)}`);
-    }
-    if (expectedAccountIds && expectedAccountIds.length > 0 && expectedAccountIds[0] !== '') {
-      let callerIdentity: Awaited<ReturnType<typeof getCallerIdentity>>;
+  ): Promise<Awaited<ReturnType<typeof getCallerIdentity>>> {
+    if (!credentials) {
+      let resolved: AwsCredentialIdentity;
      try {
-        callerIdentity = await getCallerIdentity(this.stsClient);
+        resolved = await this.loadCredentials();
+        if (!resolved.accessKeyId) {
+          throw new Error('Access key ID empty after loading credentials');
+        }
      } catch (error) {
-        throw new Error(`Could not validate account ID of credentials: ${errorMessage(error)}`);
+        throw new Error(`Credentials could not be loaded, please check your action inputs: ${errorMessage(error)}`);
      }
-      if (!callerIdentity.Account || !expectedAccountIds.includes(callerIdentity.Account)) {
-        throw new Error(
-          `The account ID of the provided credentials (${
-            callerIdentity.Account ?? 'unknown'
-          }) does not match any of the expected account IDs: ${expectedAccountIds.join(', ')}`,
-        );
-      }
-    }
-
-    if (!roleChaining) {
-      const actualAccessKeyId = credentials.accessKeyId;
-      if (expectedAccessKeyId && expectedAccessKeyId !== actualAccessKeyId) {
+      if (!roleChaining && expectedAccessKeyId && expectedAccessKeyId !== resolved.accessKeyId) {
        throw new Error(
          'Credentials loaded by the SDK do not match the expected access key ID configured by the action',
        );
      }
    }
+
+    const client = credentials ? this.createStsClient(credentials) : this.stsClient;
+    try {
+      return await getCallerIdentity(client);
+    } catch (error) {
+      throw new Error(`Credentials could not be loaded, please check your action inputs: ${errorMessage(error)}`);
+    }
  }

  private async loadCredentials() {
@@ -3,6 +3,7 @@ import * as path from 'node:path';
 import * as core from '@actions/core';
 import type { Credentials, STSClient } from '@aws-sdk/client-sts';
 import { GetCallerIdentityCommand } from '@aws-sdk/client-sts';
+import type { AwsCredentialIdentity } from '@aws-sdk/types';
 import type { UserAgent } from '@smithy/types';
 import type { CredentialsClient } from './CredentialsClient';

@@ -150,9 +151,8 @@ export async function getCallerIdentity(client: STSClient): Promise<{ Account: s
  return result;
 }

-// Obtains account ID from STS Client and sets it as output
-export async function exportAccountId(credentialsClient: CredentialsClient, maskAccountId?: boolean) {
-  const identity = await getCallerIdentity(credentialsClient.stsClient);
+// Emits the account ID and ARN of an already-resolved caller identity as action outputs.
+export function exportAccountId(identity: { Account: string; Arn: string }, maskAccountId?: boolean) {
  const accountId = identity.Account;
  const arn = identity.Arn;
  if (maskAccountId) {
@@ -164,6 +164,35 @@ export async function exportAccountId(credentialsClient: CredentialsClient, mask
  return accountId;
 }

+// Validates that the account of the already-resolved caller identity is in the allow-list provided via the
+// `allowed-account-ids` input.
+export function validateAccountId(expectedAccountIds: string[] | undefined, account: string | undefined): void {
+  if (!expectedAccountIds || expectedAccountIds.length === 0 || expectedAccountIds[0] === '') {
+    return;
+  }
+  if (!account || !expectedAccountIds.includes(account)) {
+    throw new Error(
+      `The account ID of the provided credentials (${
+        account ?? 'unknown'
+      }) does not match any of the expected account IDs: ${expectedAccountIds.join(', ')}`,
+    );
+  }
+}
+
+// Converts the STS Credentials shape (returned by AssumeRole and provided as action inputs) into
+// the AwsCredentialIdentity shape the SDK expects when credentials are supplied explicitly to a
+// client. Returns undefined if the access key ID or secret access key is missing.
+export function toCredentialIdentity(creds?: Partial<Credentials>): AwsCredentialIdentity | undefined {
+  if (!creds?.AccessKeyId || !creds.SecretAccessKey) {
+    return undefined;
+  }
+  return {
+    accessKeyId: creds.AccessKeyId,
+    secretAccessKey: creds.SecretAccessKey,
+    ...(creds.SessionToken && { sessionToken: creds.SessionToken }),
+  };
+}
+
 // Tags have a more restrictive set of acceptable characters than GitHub environment variables can.
 // This replaces anything not conforming to the tag restrictions by inverting the regular expression.
 // See the AWS documentation for constraint specifics https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html.
@@ -252,6 +281,22 @@ export function isDefined<T>(i: T | undefined | null): i is T {
 }
 /* c8 ignore stop */

+// Reads the `exp` claim (Unix seconds) from a JWT and reports whether the token is already expired or will expire
+// within `skewSeconds`. This is to decide whether to re-mint the OIDC token before an AssumeRole attempt. On any parse
+// failure we return false so a malformed token can't start a re-mint loop.
+export function jwtExpiresWithin(token: string, skewSeconds: number): boolean {
+  try {
+    const payload = token.split('.')[1];
+    if (!payload) return false;
+    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    if (typeof decoded.exp !== 'number') return false;
+    const nowSeconds = Date.now() / 1000;
+    return decoded.exp <= nowSeconds + skewSeconds;
+  } catch (_) {
+    return false;
+  }
+}
+
 export async function areCredentialsValid(credentialsClient: CredentialsClient) {
  const client = credentialsClient.stsClient;
  try {
@@ -9,14 +9,18 @@ import {
  exportCredentials,
  exportRegion,
  getBooleanInput,
+  jwtExpiresWithin,
  retryAndBackoff,
+  toCredentialIdentity,
  translateEnvVariables,
  unsetCredentials,
+  validateAccountId,
  verifyKeys,
 } from './helpers';
 import { writeProfileFiles } from './profileManager';

 const DEFAULT_ROLE_DURATION = 3600; // One hour (seconds)
+const TOKEN_REFRESH_SKEW_SECONDS = 30;
 const ROLE_SESSION_NAME = 'GitHubActions';
 const REGION_REGEX = /^[a-z0-9-]+$/g;
 const ROLE_SESSION_NAME_REGEX = /^[\w+=,.@-]*$/;
@@ -51,8 +55,8 @@ export async function run() {
    });
    const roleChaining = getBooleanInput('role-chaining', { required: false });
    const outputCredentials = getBooleanInput('output-credentials', { required: false });
-    // Default to always outputting environment credentials unless profile is specified. If profile is specified, default to
-    // no environment credentials (but still output them if the user specifically requests it).
+    // Default to always outputting environment credentials unless profile is specified. If profile is specified, default
+    // to no environment credentials (but still output them if the user specifically requests it).
    const outputEnvCredentials = getBooleanInput('output-env-credentials', { required: false, default: !awsProfile });
    const unsetCurrentCredentials = getBooleanInput('unset-current-credentials', { required: false });
    let disableRetry = getBooleanInput('disable-retry', { required: false });
@@ -198,27 +202,38 @@ export async function run() {
        writeProfileFiles(awsProfile, { AccessKeyId, SecretAccessKey, SessionToken }, region, overwriteAwsProfile);
      }
    } else if (!webIdentityTokenFile && !roleChaining) {
-      // Proceed only if credentials can be picked up
-      await withRetry(
-        () => credentialsClient.validateCredentials(undefined, roleChaining, expectedAccountIds),
+      // Proceed only if credentials can be picked up. validateCredentials resolves the ambient
+      // credentials via the SDK default chain, proves they work, and returns the caller identity.
+      const identity = await withRetry(
+        () => credentialsClient.validateCredentials(undefined, undefined, roleChaining),
        'validateCredentials',
      );
-      sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+      // Enforce the allowed-account-ids guardrail unless a role will be assumed, in which case the
+      // final account is validated after assumeRole (these ambient credentials are the source account).
+      if (!roleToAssume) {
+        validateAccountId(expectedAccountIds, identity.Account);
+      }
+      sourceAccountId = exportAccountId(identity, maskAccountId);
    }

    if (AccessKeyId || roleChaining) {
-      // Validate that the SDK can actually pick up credentials.
-      // This validates cases where this action is using existing environment credentials,
-      // and cases where the user intended to provide input credentials but the secrets inputs resolved to empty strings.
-      // Skip when output-env-credentials is false: input IAM keys were not written to env, so
-      // the default chain would resolve to ambient runner credentials and the access-key check
-      // would spuriously fail (see #1554).
+      // Validate that the credentials the action will use actually work, and resolve their identity.
+      const resolutionCredentials =
+        outputEnvCredentials || !AccessKeyId
+          ? undefined
+          : toCredentialIdentity({ AccessKeyId, SecretAccessKey, SessionToken });
+      const identity = await withRetry(
+        () => credentialsClient.validateCredentials(resolutionCredentials, AccessKeyId, roleChaining),
+        'validateCredentials',
+      );
+      // Enforce the allowed-account-ids guardrail unless a role will be assumed (the final account is
+      // validated after assumeRole; these are the source credentials).
+      if (!roleToAssume) {
+        validateAccountId(expectedAccountIds, identity.Account);
+      }
+      sourceAccountId = identity.Account;
      if (outputEnvCredentials) {
-        await withRetry(
-          () => credentialsClient.validateCredentials(AccessKeyId, roleChaining, expectedAccountIds),
-          'validateCredentials',
-        );
-        sourceAccountId = await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+        exportAccountId(identity, maskAccountId);
      }
    }
    if (customTags && (useGitHubOIDCProvider() || webIdentityTokenFile)) {
@@ -233,6 +248,10 @@ export async function run() {
      let roleCredentials: AssumeRoleCommandOutput;
      do {
        roleCredentials = await withRetry(async () => {
+          if (useGitHubOIDCProvider() && jwtExpiresWithin(webIdentityToken, TOKEN_REFRESH_SKEW_SECONDS)) {
+            core.info('OIDC token has expired or is about to; requesting a fresh one before AssumeRole.');
+            webIdentityToken = await core.getIDToken(audience);
+          }
          return assumeRole({
            credentialsClient,
            sourceAccountId,
@@ -252,24 +271,15 @@ export async function run() {
      } while (specialCharacterWorkaround && !verifyKeys(roleCredentials.Credentials));
      core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser?.AssumedRoleId}`);
      exportCredentials(roleCredentials.Credentials, outputCredentials, outputEnvCredentials);
-      // Validate that the SDK can pick up the assumed-role credentials from the environment.
-      // Skip when output-env-credentials is false: the credentials were never written to env,
-      // so the default credential provider chain would resolve to ambient runner credentials
-      // (e.g. an EC2 instance profile) and the access-key-id check would spuriously fail.
-      // Skip when using a profile: validation runs after the profile file is written below.
-      if ((!process.env.GITHUB_ACTIONS || AccessKeyId) && !awsProfile && outputEnvCredentials) {
-        await withRetry(
-          () =>
-            credentialsClient.validateCredentials(
-              roleCredentials.Credentials?.AccessKeyId,
-              roleChaining,
-              expectedAccountIds,
-            ),
-          'validateCredentials',
-        );
-      }
+      // Validate the assumed-role credentials and resolve their identity.
+      const identity = await withRetry(
+        () => credentialsClient.validateCredentials(toCredentialIdentity(roleCredentials.Credentials)),
+        'validateCredentials',
+      );
+      // Enforce the allowed-account-ids guardrail against the assumed (final) account.
+      validateAccountId(expectedAccountIds, identity.Account);
      if (outputEnvCredentials) {
-        await withRetry(() => exportAccountId(credentialsClient, maskAccountId), 'exportAccountId');
+        exportAccountId(identity, maskAccountId);
      }

      // Write profile files if profile mode is enabled
@@ -279,18 +289,8 @@ export async function run() {
        }
        // If user provided IAM User Credentials and then we assumed a role, overwrite the profile file to add
        // the session token. (this only overwrites the profile within a single run of the action).
-        // We then validate the credentials to make sure they work.
        if (AccessKeyId || !process.env.GITHUB_ACTIONS) {
          writeProfileFiles(awsProfile, roleCredentials.Credentials, region, true);
-          await withRetry(
-            () =>
-              credentialsClient.validateCredentials(
-                roleCredentials.Credentials?.AccessKeyId,
-                roleChaining,
-                expectedAccountIds,
-              ),
-            'validateCredentials',
-          );
        } else {
          writeProfileFiles(awsProfile, roleCredentials.Credentials, region, overwriteAwsProfile);
        }
@@ -51,6 +51,33 @@ describe('Configure AWS Credentials helpers', {}, () => {
    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry: attempt 1 of 3 failed'));
    helpers.reset();
  });
+  describe('jwtExpiresWithin', {}, () => {
+    // Builds a JWT-shaped string (header.payload.signature) with the given payload. Only the payload
+    // segment is read by the helper; the signature is irrelevant since we never verify it.
+    const makeJwt = (payload: object) => {
+      const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+      return `${encode({ alg: 'RS256' })}.${encode(payload)}.signature`;
+    };
+    it('returns true when the token is already expired', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) - 60;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
+    });
+    it('returns true when the token expires within the skew window', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) + 10;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
+    });
+    it('returns false when the token is comfortably valid', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) + 900;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(false);
+    });
+    it('returns false for a token with no exp claim', {}, () => {
+      expect(helpers.jwtExpiresWithin(makeJwt({ sub: 'foo' }), 30)).toBe(false);
+    });
+    it('returns false for a malformed token', {}, () => {
+      expect(helpers.jwtExpiresWithin('not-a-jwt', 30)).toBe(false);
+      expect(helpers.jwtExpiresWithin('', 30)).toBe(false);
+    });
+  });
  it('can output creds when told to', {}, () => {
    vi.spyOn(core, 'setOutput').mockImplementation(() => {});
    vi.spyOn(core, 'setSecret').mockImplementation(() => {});
@@ -89,6 +89,28 @@ describe('Configure AWS Credentials', {}, () => {
      expect(core.exportVariable).toHaveBeenCalledTimes(5);
      expect(core.setFailed).not.toHaveBeenCalled();
    });
+    it('re-mints the OIDC token when it has expired during retries', {}, async () => {
+      // Helper to build a JWT with a given exp (Unix seconds). Only the payload is read by the action.
+      const makeJwt = (exp: number) => {
+        const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+        return `${encode({ alg: 'RS256' })}.${encode({ exp })}.sig`;
+      };
+      const expiredToken = makeJwt(Math.floor(Date.now() / 1000) - 60);
+      const freshToken = makeJwt(Math.floor(Date.now() / 1000) + 900);
+      // First call returns an already-expired token; the refresh inside the retry loop returns a fresh one.
+      vi.mocked(core.getIDToken).mockResolvedValueOnce(expiredToken).mockResolvedValueOnce(freshToken);
+      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      await run();
+      // Token fetched once up front, then re-minted because the first was expired.
+      expect(core.getIDToken).toHaveBeenCalledTimes(2);
+      expect(core.info).toHaveBeenCalledWith(
+        'OIDC token has expired or is about to; requesting a fresh one before AssumeRole.',
+      );
+      // The fresh token is the one actually sent to STS.
+      const call = mockedSTSClient.commandCalls(AssumeRoleWithWebIdentityCommand)[0];
+      expect(call.args[0].input.WebIdentityToken).toBe(freshToken);
+      expect(core.setFailed).not.toHaveBeenCalled();
+    });
  });

  describe('IAM User Authentication', {}, () => {
@@ -618,6 +640,9 @@ describe('Configure AWS Credentials', {}, () => {
    });
    it("doesn't export credentials as environment variables if told not to", {}, async () => {
      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      // Credentials are validated (and their account resolved) even when not exported to the
+      // environment, so GetCallerIdentity is now called on the explicit assumed-role credentials.
+      mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.NO_ENV_CREDS_INPUTS));
      vi.mocked(core.getIDToken).mockResolvedValue('testoidctoken');
      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'fake-token';
@@ -628,6 +653,7 @@ describe('Configure AWS Credentials', {}, () => {
    });
    it('can export creds as step outputs without exporting as env variables', {}, async () => {
      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.STEP_BUT_NO_ENV_INPUTS));
      vi.mocked(core.getIDToken).mockResolvedValue('testoidctoken');
      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'fake-token';
@@ -897,6 +923,65 @@ describe('Configure AWS Credentials', {}, () => {
      expect(core.info).toHaveBeenCalledWith('Authenticated as assumedRoleId AROAFAKEASSUMEDROLEID');
    });

+    it('fails with OIDC when account ID does not match allowed list', async () => {
+      // Regression test for the allowed-account-ids bypass: in a real runner (GITHUB_ACTIONS=true)
+      // authenticating via OIDC, the account-ID guardrail was previously never enforced.
+      vi.mocked(core.getInput).mockImplementation(
+        mocks.getInput({
+          ...mocks.GH_OIDC_INPUTS,
+          'allowed-account-ids': '999999999999',
+        }),
+      );
+      vi.mocked(core.getIDToken).mockResolvedValue('testoidctoken');
+      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolves(mocks.outputs.STS_CREDENTIALS);
+      mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
+      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'fake-token';
+
+      await run();
+      expect(core.setFailed).toHaveBeenCalledWith(
+        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+      );
+    });
+
+    it('fails with OIDC and output-env-credentials false when account ID does not match', async () => {
+      // The guardrail must hold even when credentials are never written to the environment.
+      vi.mocked(core.getInput).mockImplementation(
+        mocks.getInput({
+          ...mocks.NO_ENV_CREDS_INPUTS,
+          'allowed-account-ids': '999999999999',
+        }),
+      );
+      vi.mocked(core.getIDToken).mockResolvedValue('testoidctoken');
+      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolves(mocks.outputs.STS_CREDENTIALS);
+      mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
+      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'fake-token';
+
+      await run();
+      expect(core.setFailed).toHaveBeenCalledWith(
+        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+      );
+    });
+
+    it('fails with assume role when assumed account ID does not match allowed list', async () => {
+      vi.mocked(core.getInput).mockImplementation(
+        mocks.getInput({
+          ...mocks.IAM_ASSUMEROLE_INPUTS,
+          'allowed-account-ids': '999999999999',
+        }),
+      );
+      mockedSTSClient.on(AssumeRoleCommand).resolves(mocks.outputs.STS_CREDENTIALS);
+      mockedSTSClient.on(GetCallerIdentityCommand).resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
+      // biome-ignore lint/suspicious/noExplicitAny: any required to mock private method
+      vi.spyOn(CredentialsClient.prototype as any, 'loadCredentials')
+        .mockResolvedValueOnce({ accessKeyId: 'MYAWSACCESSKEYID' })
+        .mockResolvedValueOnce({ accessKeyId: 'STSAWSACCESSKEYID' });
+
+      await run();
+      expect(core.setFailed).toHaveBeenCalledWith(
+        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+      );
+    });
+
    it('handles GetCallerIdentity API failure gracefully', async () => {
      vi.mocked(core.getInput).mockImplementation(
        mocks.getInput({
@@ -911,7 +996,11 @@ describe('Configure AWS Credentials', {}, () => {
      });

      await run();
-      expect(core.setFailed).toHaveBeenCalledWith('Could not validate account ID of credentials: API Error');
+      // The account allow-list now reuses the single liveness GetCallerIdentity call, so an STS
+      // failure surfaces as a credential-loading failure rather than a dedicated account-check error.
+      expect(core.setFailed).toHaveBeenCalledWith(
+        'Credentials could not be loaded, please check your action inputs: API Error',
+      );
    });

    it('ignores validation when allowed-account-ids is empty', async () => {
@@ -1373,7 +1462,7 @@ describe('Configure AWS Credentials', {}, () => {
  });

  describe('Retry Behavior', {}, () => {
-    it('retries exportAccountId on transient GetCallerIdentity failure', async () => {
+    it('retries validateCredentials on transient GetCallerIdentity failure', async () => {
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.IAM_USER_INPUTS));
      // biome-ignore lint/suspicious/noExplicitAny: any required to mock private method
      vi.spyOn(CredentialsClient.prototype as any, 'loadCredentials').mockResolvedValue({
@@ -1384,7 +1473,9 @@ describe('Configure AWS Credentials', {}, () => {
        .rejectsOnce(new Error('throttled'))
        .resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
      await run();
-      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry exportAccountId'));
+      // The single liveness GetCallerIdentity call lives in validateCredentials, so transient STS
+      // failures are retried under that label (the account ID is then resolved without a second call).
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry validateCredentials'));
      expect(core.setFailed).not.toHaveBeenCalled();
    });

@@ -1414,7 +1505,7 @@ describe('Configure AWS Credentials', {}, () => {
      expect(core.info).not.toHaveBeenCalledWith(expect.stringContaining('Retry'));
    });

-    it('retries exportAccountId after role assumption (issue #1681)', async () => {
+    it('retries the post-assume identity check on a transient invalid-token error (issue #1681)', async () => {
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.GH_OIDC_INPUTS));
      vi.mocked(core.getIDToken).mockResolvedValue('testoidctoken');
      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolves(mocks.outputs.STS_CREDENTIALS);
@@ -1424,7 +1515,9 @@ describe('Configure AWS Credentials', {}, () => {
        .resolves({ ...mocks.outputs.GET_CALLER_IDENTITY });
      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'fake-token';
      await run();
-      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry exportAccountId'));
+      // Freshly-assumed credentials can be briefly rejected by STS (eventual consistency). The
+      // liveness GetCallerIdentity now runs inside validateCredentials, so the retry happens there.
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry validateCredentials'));
      expect(core.info).toHaveBeenCalledWith(
        expect.stringContaining('The security token included in the request is invalid'),
      );
@@ -50,7 +50,7 @@ describe('Profile Manager', {}, () => {

    it('guards against __proto__ section pollution', {}, () => {
      const result = parseIni('[__proto__]\npolluted=true\n[safe]\nkey=val\n');
-      expect(result.__proto__).not.toHaveProperty('polluted');
+      expect(Object.getPrototypeOf(result)).not.toHaveProperty('polluted');
      expect(result.safe).toEqual({ key: 'val' });
    });