From 552e3103594839c54c7045913cf5aaf13c3506a2 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 27 Jul 2026 13:00:58 -0700 Subject: [PATCH] Pin configure-aws-credentials to a SHA and bump to v6.2.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v4 is the last Node 20 deprecation warning on this workflow. v6's only breaking change is requiring a Node 24 runner, which ubuntu-latest already forces — that is what the warning was about. v5's only breaking change was invalid boolean input handling, and this step passes no boolean inputs. Pinned by commit SHA rather than tag. Tags are mutable, and this is the step that mints AWS credentials, so a moved tag would be an unreviewed change to what can assume the upload role. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/upload-assets.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/upload-assets.yml b/.github/workflows/upload-assets.yml index 4812a0a3..8336e920 100644 --- a/.github/workflows/upload-assets.yml +++ b/.github/workflows/upload-assets.yml @@ -90,7 +90,10 @@ jobs: - name: Configure AWS credentials if: steps.plan.outputs.count != '0' && inputs.dry_run != true - uses: aws-actions/configure-aws-credentials@v4 + # Pinned to a commit SHA, not a tag: tags are mutable, and this action + # mints AWS credentials. v6 requires a Node 24 runner, which + # ubuntu-latest already provides. + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ vars.AWS_ASSETS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }}