Change CI to use OIDC (#1740)

* update aws * fix * fix * test * fix * for quicker test * test * test * test * fix * fix * test * test * test * test * test * test * test * test * test * fix * update role Co-authored-by: Weisu Yin <[email protected]>
dmlc · Mar 30, 2022 · 896df4e · 896df4e
1 parent 0baa50a
commit 896df4e
Showing 1 changed file with 12 additions and 8 deletions.
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
@@ -4,6 +4,10 @@ on:
     workflows: ["Unit Test"]
     types:
       - completed
+permissions:
+      id-token: write
+      contents: read
+      statuses: write
 jobs:
   unittest-check:
     runs-on: ubuntu-latest
@@ -48,8 +52,8 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.GLUONCV_DEV_ACCESS_ID }}
-          aws-secret-access-key: ${{ secrets.GLUONCV_DEV_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.GLUONCV_CI_ROLE }}
+          role-duration-seconds: 7200
           aws-region: us-east-1
       - name: Install dependencies
         run: |
@@ -118,8 +122,8 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.GLUONCV_DEV_ACCESS_ID }}
-          aws-secret-access-key: ${{ secrets.GLUONCV_DEV_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.GLUONCV_CI_ROLE }}
+          role-duration-seconds: 7200
           aws-region: us-east-1
       - name: Install dependencies
         run: |
@@ -188,8 +192,8 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.GLUONCV_DEV_ACCESS_ID }}
-          aws-secret-access-key: ${{ secrets.GLUONCV_DEV_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.GLUONCV_CI_ROLE }}
+          role-duration-seconds: 7200
           aws-region: us-east-1
       - name: Install dependencies
         run: |
@@ -262,8 +266,8 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.GLUONCV_DEV_ACCESS_ID }}
-          aws-secret-access-key: ${{ secrets.GLUONCV_DEV_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.GLUONCV_CI_ROLE }}
+          role-duration-seconds: 7200
           aws-region: us-east-1
       - name: Install dependencies
         run: |