ci: harden aws-actions/configure-aws-credentials (v6.1.0 + retry)#5981
Merged
ci: harden aws-actions/configure-aws-credentials (v6.1.0 + retry)#5981
Conversation
…attempts: 5
Addresses a silent failure of the Configure AWS Credentials step on a
windows-build-test leg in run 24911558626 job 72954213459: the step
produced no log output between its setup group and end-group, was
marked failed, and skipped every subsequent build/test step in that
job. Classic pattern for an OIDC-to-STS flake that the older action
version was swallowing without any surfaced error.
Two changes here, both small:
1. Pin every invocation of aws-actions/configure-aws-credentials to
v6.1.0 (commit ec61189d). Previously we had a mix:
- three v4 SHAs (4ce2bbcf, in build-test-windows / pip-build /
prepare-images)
- one different v4 SHA (e3dd6a42, in the python-regression-tests
composite action)
- four floating @v6 tag refs (build-test-distribute +
unity-nuget-test ×3)
v6.1.0 carries improved error reporting for OIDC-token-fetch and
STS-call failures -- the exact modes that failed silently on v4. The
unpinned @v6 refs are now SHA-pinned for supply-chain hygiene.
2. Add `retry-max-attempts: 5` to every invocation (default is 3).
Retries the STS AssumeRoleWithWebIdentity call on transient 5xx /
throttle responses from AWS. No effect on legitimate IAM denies,
which fail on the first call with 4xx and skip the retry loop.
Scope: 5 files, 8 step instances, no behavioural change on the happy
path. No workflow-permissions / role-to-assume / region changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unify every
aws-actions/configure-aws-credentialsinvocation in this repo on v6.1.0 SHA-pinned and addretry-max-attempts: 5to each. Motivated by a silent failure of the step on awindows-build-testleg in run 24911558626: the older v4 SHA swallowed the error without printing anything, leaving no way to tell whether the GitHub OIDC fetch or the AWS STS call was responsible.Changes
Eight invocations across five files, all touched uniformly:
.github/workflows/build-test-windows.yml@4ce2bbcf # v4@ec61189d # v6.1.0.github/workflows/pip-build.yml@4ce2bbcf # v4@ec61189d # v6.1.0.github/workflows/prepare-images.yml@4ce2bbcf # v4@ec61189d # v6.1.0.github/actions/python-regression-tests/action.yml@e3dd6a42 # v4@ec61189d # v6.1.0.github/workflows/build-test-distribute.yml@v6(unpinned)@ec61189d # v6.1.0.github/workflows/unity-nuget-test.yml@v6(unpinned)@ec61189d # v6.1.0retry-max-attempts: 5is added to thewith:block of each invocation. Default is 3.Why v6.1.0
v4.0.2-era SHA we had pinned in build-test-windows et al. The v5 and v6 branches both improved diagnostics for the OIDC-token-fetch / STS-AssumeRole paths. v4's quiet-fail on those paths is the exact behaviour we want to stop hiding.build-test-distribute.ymlandunity-nuget-test.ymlwere already using (just unpinned), so we don't cross a major version boundary anywhere — just converge on one SHA and stop drifting.Why
retry-max-attempts: 5AssumeRoleWithWebIdentitycall only. Retries on transient 5xx / throttle responses.What this PR deliberately does NOT do
permissions:block changes —id-token: writewas already set everywhere it's needed.role-to-assume/aws-region/output-credentialschanges.env: ACTIONS_STEP_DEBUG: true— kept for a follow-up if we still see silent failures after this lands. (Would double log volume, worth paying only if v6.1.0 alone isn't enough.)Test plan
grep -c 'configure-aws-credentials@ec61189d' .githubreturns 8).aws s3 sync,aws ec2 start/stop-instances, etc.).🤖 Generated with Claude Code