Skip to content

Commit 3491a0b

Browse files
jruauxjruaux
authored
feat: add AWS OIDC authentication support (#7)
- Add configure-aws composite action supporting both OIDC and static credentials - Update build.yml workflow with optional AWS authentication and extra-env input - Update release.yml to use configure-aws action and support OIDC - OIDC is the recommended approach (no long-lived credentials) Usage in build.yml: uses: redis/github-workflows/.github/workflows/build.yml@main with: aws-role-arn: arn:aws:iam::ACCOUNT:role/GitHubActions aws-region: us-west-1 extra-env: '{"S3_TEST_BUCKET": "my-bucket"}' AWS IAM setup required: 1. Create OIDC identity provider for token.actions.githubusercontent.com 2. Create IAM role with trust policy for your repository 3. Attach required permissions (e.g., S3 access) to the role
1 parent a0ba25d commit 3491a0b

File tree

4 files changed

+117
-5
lines changed

4 files changed

+117
-5
lines changed

‎.github/actions/configure-aws/action.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: 'Configure AWS Credentials'
2+
description: 'Configure AWS credentials using OIDC (preferred) or static credentials'
3+
4+
inputs:
5+
aws-role-arn:
6+
description: 'AWS IAM role ARN for OIDC authentication (recommended)'
7+
required: false
8+
aws-access-key-id:
9+
description: 'AWS access key ID (fallback if OIDC role not provided)'
10+
required: false
11+
aws-secret-access-key:
12+
description: 'AWS secret access key (fallback if OIDC role not provided)'
13+
required: false
14+
aws-region:
15+
description: 'AWS region'
16+
required: false
17+
default: 'us-east-1'
18+
role-session-name:
19+
description: 'Session name for OIDC role assumption'
20+
required: false
21+
default: 'github-actions'
22+
23+
outputs:
24+
aws-configured:
25+
description: 'Whether AWS credentials were configured'
26+
value: ${{ steps.check.outputs.configured }}
27+
28+
runs:
29+
using: 'composite'
30+
steps:
31+
- name: Check AWS configuration
32+
id: check
33+
shell: bash
34+
run: |
35+
if [[ -n "${{ inputs.aws-role-arn }}" ]]; then
36+
echo "configured=true" >> $GITHUB_OUTPUT
37+
echo "method=oidc" >> $GITHUB_OUTPUT
38+
elif [[ -n "${{ inputs.aws-access-key-id }}" && -n "${{ inputs.aws-secret-access-key }}" ]]; then
39+
echo "configured=true" >> $GITHUB_OUTPUT
40+
echo "method=static" >> $GITHUB_OUTPUT
41+
else
42+
echo "configured=false" >> $GITHUB_OUTPUT
43+
echo "method=none" >> $GITHUB_OUTPUT
44+
fi
45+
46+
- name: Configure AWS credentials (OIDC)
47+
if: steps.check.outputs.method == 'oidc'
48+
uses: aws-actions/configure-aws-credentials@v4
49+
with:
50+
role-to-assume: ${{ inputs.aws-role-arn }}
51+
role-session-name: ${{ inputs.role-session-name }}
52+
aws-region: ${{ inputs.aws-region }}
53+
54+
- name: Configure AWS credentials (Static)
55+
if: steps.check.outputs.method == 'static'
56+
uses: aws-actions/configure-aws-credentials@v4
57+
with:
58+
aws-access-key-id: ${{ inputs.aws-access-key-id }}
59+
aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
60+
aws-region: ${{ inputs.aws-region }}
61+

‎.github/workflows/build.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,35 @@ on:
1313
default: 'build'
1414
required: false
1515
type: string
16+
aws-role-arn:
17+
description: 'AWS IAM role ARN for OIDC authentication (for integration tests)'
18+
required: false
19+
type: string
20+
aws-region:
21+
description: 'AWS region (used with aws-role-arn or aws secrets)'
22+
default: 'us-east-1'
23+
required: false
24+
type: string
25+
extra-env:
26+
description: 'Extra environment variables as JSON object (e.g., {"S3_TEST_BUCKET": "my-bucket"})'
27+
default: '{}'
28+
required: false
29+
type: string
30+
secrets:
31+
aws-access-key-id:
32+
description: 'AWS access key ID (alternative to OIDC)'
33+
required: false
34+
aws-secret-access-key:
35+
description: 'AWS secret access key (alternative to OIDC)'
36+
required: false
1637

1738
jobs:
1839
build:
1940
name: Build and Test
2041
runs-on: ubuntu-latest
42+
permissions:
43+
contents: read
44+
id-token: write # Required for OIDC
2145

2246
steps:
2347
- name: Checkout code
@@ -30,6 +54,20 @@ jobs:
3054
distribution: 'temurin'
3155
cache: 'gradle'
3256

57+
- name: Configure AWS credentials
58+
if: inputs.aws-role-arn != '' || (secrets.aws-access-key-id != '' && secrets.aws-secret-access-key != '')
59+
uses: redis/github-workflows/.github/actions/configure-aws@main
60+
with:
61+
aws-role-arn: ${{ inputs.aws-role-arn }}
62+
aws-access-key-id: ${{ secrets.aws-access-key-id }}
63+
aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
64+
aws-region: ${{ inputs.aws-region }}
65+
66+
- name: Set extra environment variables
67+
if: inputs.extra-env != '{}'
68+
run: |
69+
echo '${{ inputs.extra-env }}' | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
70+
3371
- name: Grant execute permission for gradlew
3472
run: chmod +x gradlew
3573

‎.github/workflows/release.yml‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,15 @@ on:
7777
default: false
7878
required: false
7979
type: boolean
80+
aws-role-arn:
81+
description: 'AWS IAM role ARN for OIDC authentication (for pre-release-script)'
82+
required: false
83+
type: string
84+
aws-region:
85+
description: 'AWS region (used with aws-role-arn or aws secrets)'
86+
default: 'us-east-1'
87+
required: false
88+
type: string
8089
secrets:
8190
git-access-token:
8291
description: 'GitHub token with write access'
@@ -106,10 +115,10 @@ on:
106115
description: 'Docker registry password (for bootBuildImage)'
107116
required: false
108117
aws-access-key-id:
109-
description: 'AWS access key ID (for pre-release-script)'
118+
description: 'AWS access key ID (for pre-release-script, alternative to OIDC)'
110119
required: false
111120
aws-secret-access-key:
112-
description: 'AWS secret access key (for pre-release-script)'
121+
description: 'AWS secret access key (for pre-release-script, alternative to OIDC)'
113122
required: false
114123

115124
jobs:
@@ -118,6 +127,7 @@ jobs:
118127
permissions:
119128
contents: write
120129
packages: write
130+
id-token: write # Required for AWS OIDC
121131

122132
steps:
123133
- name: Checkout
@@ -149,12 +159,13 @@ jobs:
149159
run: ./gradlew ${{ inputs.gradle-build-tasks }} ${{ inputs.skip-tests && '-x test' || '' }}
150160

151161
- name: Configure AWS credentials
152-
if: inputs.pre-release-script != ''
153-
uses: aws-actions/configure-aws-credentials@v4
162+
if: inputs.pre-release-script != '' && (inputs.aws-role-arn != '' || (secrets.aws-access-key-id != '' && secrets.aws-secret-access-key != ''))
163+
uses: redis/github-workflows/.github/actions/configure-aws@main
154164
with:
165+
aws-role-arn: ${{ inputs.aws-role-arn }}
155166
aws-access-key-id: ${{ secrets.aws-access-key-id }}
156167
aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
157-
aws-region: us-east-1
168+
aws-region: ${{ inputs.aws-region }}
158169
continue-on-error: true
159170

160171
- name: Pre-Release Script

‎AGENTS.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ uses: redis/github-workflows/.github/actions/jreleaser@main
2121
│ └── docs.yml # Antora documentation build + GitHub Pages
2222
└── actions/ # Composite actions
2323
├── setup-gradle/ # Java + Gradle setup with caching
24+
├── configure-aws/ # AWS credentials via OIDC or static keys
2425
├── jreleaser/ # GitHub release, Maven Central, Docker, Slack
2526
├── create-release-tag/ # Axion-based version tagging
2627
├── build-docs/ # Antora documentation builder
@@ -42,6 +43,7 @@ uses: redis/github-workflows/.github/actions/jreleaser@main
4243
| Action | Purpose |
4344
|--------|---------|
4445
| `setup-gradle` | Setup Java (Temurin) + Gradle with caching |
46+
| `configure-aws` | Configure AWS credentials via OIDC (preferred) or static credentials |
4547
| `jreleaser` | Run JReleaser for releases, signing, publishing |
4648
| `create-release-tag` | Create Git tag using Axion release plugin |
4749
| `build-docs` | Build Antora documentation with Algolia search |

0 commit comments

Comments
 (0)