Migrate release workflows from PAT secrets to OIDC + Secrets Manager - #4703
Draft
vcjana wants to merge 4 commits into
Draft
Migrate release workflows from PAT secrets to OIDC + Secrets Manager#4703vcjana wants to merge 4 commits into
vcjana wants to merge 4 commits into
Conversation
|
A new generated diff is ready to view.
A new doc preview is ready to view. |
vcjana
marked this pull request as ready for review
June 16, 2026 20:56
ysaito1001
approved these changes
Jun 18, 2026
Collaborator
There was a problem hiding this comment.
+1 for removing this workflow now that this PR edits it. The work used to exist to test out rust code in aws-doc-sdk-examples using not-yet-released codegen changes in smithy-rs (the work updates the next branch in aws-sdk-rust but that branch hasn't been updated for the last two years).
It was more useful in the days AWS SDKs were pre-GA, causing more breaking changes for examples. Since they've become GA, there hasn't been much value in having next branch as well as this workflow.
vcjana
marked this pull request as draft
June 19, 2026 16:54
#4745 deleted the GitHub-Actions release suite (release/prod-release/dry-run{,-scheduled}/backport and create-release.js) now that Catapult owns smithy-rs releases. Our branch had migrated those same files to OIDC, so accept the deletions -- migrating removed files is dead work. The migration is kept only on the six non-release workflows that survive on main and still authenticated via RELEASE_AUTOMATION_BOT_PAT: claim-crate-names, credentials-verification, update-sdk-next, and the three lockfile-update workflows.
|
A new generated diff is ready to view.
A new doc preview is ready to view. |
|
A new generated diff is ready to view.
A new doc preview is ready to view. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates release/automation workflows from using GitHub repo secrets (
RELEASE_AUTOMATION_BOT_PAT,RELEASE_AUTOMATION_BOT_CRATESIO_TOKEN) to fetching the credentials at runtime from AWS Secrets Manager via OIDC role assumption.Depends on a separate change that creates the IAM role and adds
SMITHY_RS_RELEASE_OPS_ROLE_ARNas a GitHub repo secret. DO NOT MERGE until that has deployed.