Merge pull request #710 from mbta/github-actions-krj

Chore: Update GitHub actions to use assumed role
mbta · Oct 18, 2023 · acfa18b · acfa18b
2 parents 1404138 + b3ca1b3
commit acfa18b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 6 deletions.
diff --git a/.github/workflows/dev-green.yml b/.github/workflows/dev-green.yml
@@ -6,14 +6,16 @@ on:
 jobs:
   Build:
     runs-on: windows-2019
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
-      - uses: mbta/actions/build-push-ecr@v1
+      - uses: mbta/actions/build-push-ecr@v2
         id: build-push
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           docker-repo: ${{ secrets.DOCKER_REPO }}
   deploy:
     name: Deploy

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
@@ -8,14 +8,16 @@ on:
 jobs:
   Build:
     runs-on: windows-2019
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
-      - uses: mbta/actions/build-push-ecr@v1
+      - uses: mbta/actions/build-push-ecr@v2
         id: build-push
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           docker-repo: ${{ secrets.DOCKER_REPO }}
   deploy:
     name: Deploy