Merge pull request hms-dbmi-cellenics#501 from biomage-org/move-to-oi…

…dc-v2

Add write permissions for pull request and try moving to OIDC again

.github/workflows/ci.yaml

@@ -15,7 +15,12 @@ on:
       - opened
       - synchronize
       - reopened
-
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
 jobs:
   is-safe-to-run:
     name: Sensitive jobs are safe to be run
@@ -219,10 +224,9 @@ jobs:
 
       - id: setup-aws
         name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ci-role-api
           aws-region: ${{ secrets.AWS_REGION }}
 
       - id: login-ecr
@@ -275,10 +279,9 @@ jobs:
 
       - id: setup-aws
         name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ci-role-api
           aws-region: ${{ secrets.AWS_REGION }}
 
       - id: login-ecr