chore(ci): Update AWS credentials configuration in workflows

[macalbert]

Pull Request

What does this PR do?

This PR migrates the GitHub Actions workflow from using static AWS credentials to OpenID Connect (OIDC) authentication, significantly enhancing security by eliminating the need to store long-lived AWS credentials as secrets. The workflow now uses aws-actions/configure-aws-credentials@v5 with role assumption through OIDC federation, following AWS security best practices. Additionally, the AWS region is now externalized to GitHub Secrets for better configuration management.

Related issues

Type of change

• Feature
• Bugfix
• Refactor
• Documentation
• Other

Checklist

• Tests added/updated (if needed)
• Docs updated (if needed)
• Lint/format pass

Notes for reviewer

Security Improvements:

• Replaced static AWS credentials with OIDC-based authentication
• The AWS role ARN is retrieved from GitHub Secrets (AWS_ROLE_TO_ASSUME)
• AWS region is now also stored in GitHub Secrets (AWS_REGION) for better configuration management and flexibility
• The assumed role has least-privilege permissions, scoped specifically to:
  • Read and write access to AWS Systems Manager Parameter Store for test environment only
  • Permissions are granularly defined to minimize potential security exposure

Implementation Details:

• Uses aws-actions/configure-aws-credentials@v5 action
• Both role ARN and region are configured via GitHub Secrets
• OIDC trust relationship must be configured on the AWS side between GitHub and the IAM role

Prerequisites:

• AWS IAM OIDC provider must be configured for GitHub Actions
• IAM role with trust policy allowing GitHub Actions from this repository
• Required GitHub Secrets:
  • AWS_ROLE_TO_ASSUME: IAM role ARN with test Parameter Store permissions
  • AWS_REGION: AWS region (e.g., eu-west-1)

This change follows GitHub's recommended security practices for AWS authentication and eliminates the risk associated with credential leakage or rotation. Externalizing the region to secrets also improves configuration flexibility and consistency across workflows.

Summary by CodeRabbit

• Chores
  • Improved CI/CD security by switching from static AWS access keys to role-based (OIDC) authentication across workflows.
  • Moved AWS region configuration to a secrets-based source instead of a hardcoded value.
  • Granted workflow permission for OIDC token issuance to support the new authentication flow.
  • Minor workflow formatting tidy-up.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Walkthrough

Three GitHub Actions workflows switch AWS authentication from static access keys to OIDC role-assumption (role-to-assume) and source AWS region from repository secrets; workflow permissions now include id-token: write. Minor step name formatting was adjusted.

Changes

Cohort / File(s)	Summary
Workflows updated to OIDC role assumption .github/workflows/coverage-report.yml, .github/workflows/publish.yml, .github/workflows/tests.yml	Replaced static aws-access-key-id/aws-secret-access-key inputs with role-to-assume (using AWS_ROLE_TO_ASSUME); switched hardcoded region to secret-derived value (AWS_REGION); added top-level permissions: id-token: write; minor step name formatting tweaks.

Sequence Diagram(s)

sequenceDiagram
    participant GH as GitHub Actions
    participant OIDC as GitHub OIDC Provider
    participant AWS as AWS STS
    participant Action as configure-aws-credentials step
    rect rgb(235,245,255)
      Note over GH,OIDC: New permission: id-token: write
    end
    GH->>OIDC: Request ID token (repo & workflow)
    OIDC->>GH: Return ID token
    GH->>AWS: AssumeRoleWithWebIdentity(ID token, role-to-assume)
    AWS-->>GH: Temporary credentials (AccessKey, Secret, SessionToken)
    GH->>Action: Provide temporary creds + region (from AWS_REGION secret)
    Action-->>GH: AWS client configured (calls to AWS use assumed role)

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Check workflows consume AWS_ROLE_TO_ASSUME and AWS_REGION secrets correctly.
• Verify permissions: id-token: write is present and correctly indented at top level.
• Confirm no remaining hardcoded AWS keys or region strings in these files.

Possibly related PRs

• Implement Code Coverage Reporting and Deployment to GitHub Pages #2 — Modifies .github/workflows/coverage-report.yml; likely related due to overlapping workflow changes.
• feat(ci): enable npm trusted publishing with OIDC authentication #80 — Also converts CI workflows to OIDC-based authentication and adds id-token: write; strong overlap with these edits.

Poem

🐰 Keys set free beneath moonlight,
I hop to roles that fit just right.
No more secrets tucked away—
OIDC guides the workflow's sway.
A little hop, a safer night.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The PR title "chore(ci): Update AWS credentials configuration in workflows" accurately describes the main operational change across the pull request. The title is clear and specific enough that a teammate scanning the history would understand that AWS credentials configuration in workflows was modified. While the title doesn't explicitly highlight the security improvement aspect (OIDC migration), the instructions acknowledge that titles don't need to cover every detail, and this one captures the essential change being made across the three affected workflow files.
Description Check	✅ Passed	The PR description follows the repository template structure and includes all required sections. The "What does this PR do?" section provides a comprehensive explanation of the OIDC migration and security benefits. The type of change is properly selected (Feature), and all checklist items are marked as completed. The "Notes for reviewer" section goes beyond the template by providing extensive detail on security improvements, implementation details, and prerequisites, which demonstrates thoroughness. The "Related issues" section is present and appropriately empty if no related issues exist.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch macalbert/enable-oidc-for-aws

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 48f85b0 and 4467fc1.

📒 Files selected for processing (3)

• .github/workflows/coverage-report.yml (2 hunks)
• .github/workflows/publish.yml (1 hunks)
• .github/workflows/tests.yml (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/coverage-report.yml
• .github/workflows/publish.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: powerup-test

🔇 Additional comments (2)

.github/workflows/tests.yml (2)

3-7: Permission block correctly adds id-token: write for OIDC.

The addition of id-token: write is required for OIDC authentication and the inline comment clearly documents its purpose.

---

49-53: OIDC configuration looks correct.

The workflow now uses role-to-assume with a secret reference instead of static credentials, and sources the region from a secret. This aligns with the OIDC migration objectives and follows aws-actions/configure-aws-credentials@v5 conventions.

Please verify the following:

1. The required secrets AWS_ROLE_TO_ASSUME (IAM role ARN with test Parameter Store permissions) and AWS_REGION (e.g., eu-west-1) are configured in the repository settings.
2. The corresponding AWS IAM OIDC provider and role trust policy have been configured to permit GitHub Actions for this repository.
3. The mentioned workflows (coverage-report.yml and publish.yml) have been updated consistently with the same permissions and credentials configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull Request Overview

This PR migrates AWS authentication from static credentials to IAM role assumption using OIDC (OpenID Connect) for improved security across all GitHub Actions workflows.

• Replaced aws-access-key-id and aws-secret-access-key with role-to-assume parameter
• Removed quotes from aws-region value for consistency
• Applied changes uniformly across tests, publish, and coverage-report workflows

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/tests.yml	Updated AWS authentication to use IAM role assumption instead of static credentials
.github/workflows/publish.yml	Updated AWS authentication to use IAM role assumption instead of static credentials
.github/workflows/coverage-report.yml	Updated AWS authentication to use IAM role assumption and removed trailing whitespace

Comments suppressed due to low confidence (1)

.github/workflows/publish.yml:14

• The id-token: write permission is already present in this workflow, which is required for OIDC authentication with AWS. Ensure that the same permission is added to .github/workflows/tests.yml and .github/workflows/coverage-report.yml as they are now using role-to-assume but may lack the necessary OIDC permission.

  id-token: write  # Required for OIDC

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/tests.yml (1)

3-6: Add required id-token: write permission for OIDC.

The permissions block is missing id-token: write, which is required for OIDC federation. Without this permission, the configure-aws-credentials step cannot generate the OIDC token needed to assume the IAM role, causing the workflow to fail when attempting AWS Parameter Store access.

 permissions:
   checks: write
   pull-requests: write
   contents: read
+  id-token: write

🧹 Nitpick comments (1)

.github/workflows/coverage-report.yml (1)

44-44: Remove trailing whitespace from step name.

Line 44 contains trailing spaces after the step name that should be trimmed for consistency.

-      - name: 🪙 Collect Coins (Configure AWS credentials)      
+      - name: 🪙 Collect Coins (Configure AWS credentials)

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e5883ae and 48f85b0.

📒 Files selected for processing (3)

• .github/workflows/coverage-report.yml (1 hunks)
• .github/workflows/publish.yml (1 hunks)
• .github/workflows/tests.yml (1 hunks)

🔇 Additional comments (3)

.github/workflows/publish.yml (1)

57-62: Verify region configuration aligns with PR objectives.

The implementation uses a hardcoded region (eu-west-1 at line 62), but the PR objectives state the workflow should retrieve the region from the AWS_REGION secret. Clarify whether the region should be externalized to a secret as intended or if hardcoding is intentional for this environment.

.github/workflows/coverage-report.yml (1)

44-48: Verify region configuration aligns with PR objectives.

Similar to publish.yml, this workflow uses hardcoded eu-west-1 instead of the AWS_REGION secret mentioned in the PR objectives. Ensure consistency across all workflows and clarify the intent.

.github/workflows/tests.yml (1)

48-52: Verify region configuration aligns with PR objectives.

Like the other workflows, this uses hardcoded eu-west-1 instead of the AWS_REGION secret mentioned in PR objectives. Ensure the region configuration strategy is consistent across all three workflows.