Merge pull request hms-dbmi-cellenics#495 from biomage-org/move-to-oidc

Move to OIDC -- test
biomage-org · Oct 27, 2023 · 820c07d · 820c07d
2 parents ee69a1c + 766f09d
commit 820c07d
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 36 deletions.
diff --git a/.ci.yaml b/.ci.yaml
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -15,6 +15,11 @@ on:
       - opened
       - synchronize
       - reopened
+
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   is-safe-to-run:
     name: Sensitive jobs are safe to be run
@@ -216,13 +221,13 @@ jobs:
           IMAGE_REPO_NAME=$(echo $GITHUB_REPOSITORY | awk -F '/' '{print $2}')
           echo "repo-name=$IMAGE_REPO_NAME" >> $GITHUB_OUTPUT
 
-      - id: set-up-creds
+      - id: setup-aws
         name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v2
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ci-role-api
           aws-region: ${{ secrets.AWS_REGION }}
+
       - id: login-ecr
         name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@v1
@@ -273,10 +278,9 @@ jobs:
 
       - id: setup-aws
         name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v2
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ci-role-api
           aws-region: ${{ secrets.AWS_REGION }}
 
       - id: login-ecr