Skip to content

feat(gha): Set workflow permissions for OIDC #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SafeEval merged 14 commits into from
Aug 25, 2025
Merged

feat(gha): Set workflow permissions for OIDC #27

Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
2a0bc13
feat(release): id-token write permissions
SafeEval Aug 24, 2025
dd1f43f
feat(gha): workflow to verify AWS OIDC
SafeEval Aug 24, 2025
976daea
feat(gha): add OIDC debug
SafeEval Aug 24, 2025
822a08c
fix(gha): add audience to OIDC debug
SafeEval Aug 24, 2025
dfecff5
fix: use main
SafeEval Aug 24, 2025
900eea4
fix: no fail on error
SafeEval Aug 24, 2025
8844db3
fix: remove fail-on-error
SafeEval Aug 24, 2025
63bc213
fix: skip session tagging
SafeEval Aug 24, 2025
3997e2a
Update OIDC debugger aud
SafeEval Aug 24, 2025
a05f270
feat: enable session tagging
SafeEval Aug 25, 2025
c503526
chore: pin OIDC debug action by SHA
SafeEval Aug 25, 2025
f503a46
chore: rename release workflow names
SafeEval Aug 25, 2025
2428e80
chore: remove test workflow
SafeEval Aug 25, 2025
a3cdef6
Merge branch 'main' into set-workflow-permissions-for-oidc
SafeEval Aug 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,21 +30,26 @@ jobs:
- name: Setup Python
uses: actions/setup-python@v5

- name: Install uv
- name: Setup uv
uses: astral-sh/[email protected]

- name: Setup
- name: Setup packages
run: uv run task setup

- name: Build
- name: Build image
run: uv run task build

- name: Show OIDC
uses: github/actions-oidc-debugger@018a1dc4f8e47adca924d55e4bb0ddce917af32d
with:
audience: sts.amazonaws.com

- name: Setup AWS
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: ${{ vars.AWS_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-actions-release-ecr

- name: Release (ECR)
- name: Release image
run: uv run task release-ecr-no-build