docker/build-push-action
1
0
Fork 0
mirror of https://github.com/docker/build-push-action.git synced 2026-05-30 18:08:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(e2e): replace AWS_ACCESS_KEY_ID secrets with OIDC role assumption

Browse Source 
Adds aws-role-to-assume input to .e2e-run.yml. Adds configure-aws-credentials
step (pinned SHA, with role-session-name) before the Login to Registry step,
conditioned on ECR registry detection. Updates e2e.yml to pass the OIDC role
ARN and remove AWS secrets from the matrix credential expressions.

Role: arn:aws:iam::175142243308:role/official_gha_cicd
Action: aws-actions/configure-aws-credentials@7474bc4690

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Michael Zampani
2026-05-29 23:07:27 -07:00
parent f9f3042f7e
commit df9c7450bf
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/e2e.yml vendored
View File

@@ -2,6 +2,7 @@ name: e2e
permissions:
contents: read
id-token: write
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
@@ -99,14 +100,15 @@ jobs:
name: ${{ matrix.name }}
registry: ${{ matrix.registry }}
slug: ${{ matrix.slug }}
aws-role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd
secrets:
# Pass only the two secrets needed by each matrix entry.
# AWS ECR entries use OIDC via aws-role-to-assume instead of static keys.
registry_username: >-
${{
matrix.auth == 'dockerhub' && secrets.DOCKERHUB_USERNAME ||
matrix.auth == 'ghcr' && secrets.GHCR_USERNAME ||
matrix.auth == 'gitlab' && secrets.GITLAB_USERNAME ||
matrix.auth == 'aws' && secrets.AWS_ACCESS_KEY_ID ||
matrix.auth == 'gar' && secrets.GAR_USERNAME ||
matrix.auth == 'acr' && secrets.AZURE_CLIENT_ID ||
matrix.auth == 'quay' && secrets.QUAY_USERNAME ||
@@ -118,7 +120,6 @@ jobs:
matrix.auth == 'dockerhub' && secrets.DOCKERHUB_TOKEN ||
matrix.auth == 'ghcr' && secrets.GHCR_PAT ||
matrix.auth == 'gitlab' && secrets.GITLAB_TOKEN ||
matrix.auth == 'aws' && secrets.AWS_SECRET_ACCESS_KEY ||
matrix.auth == 'gar' && secrets.GAR_JSON_KEY ||
matrix.auth == 'acr' && secrets.AZURE_CLIENT_SECRET ||
matrix.auth == 'quay' && secrets.QUAY_TOKEN ||