Merge pull request #333 from rstudio/github-actions-ci

update GH actions to use OpenID connect
rstudio · Dec 5, 2022 · 7f2c6b8 · 7f2c6b8
2 parents 9ea1361 + ae30177
commit 7f2c6b8
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -94,10 +94,10 @@ jobs:
         asset_name: ${{ steps.create_dist.outputs.whl_basename }}
         asset_content_type: application/x-wheel+zip
     - uses: aws-actions/configure-aws-credentials@v1
+      id: creds
       with:
-        aws-access-key-id: ${{ secrets.AWS_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET }}
-        aws-region: us-east-1
+        role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+        aws-region: ${{ secrets.AWS_REGION }}
     - if: github.event_name == 'push' && github.ref == 'refs/heads/master'
       run: make sync-latest-to-s3
     - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
@@ -117,10 +117,10 @@ jobs:
         name: docs
         path: docs/site/
     - uses: aws-actions/configure-aws-credentials@v1
+      id: creds
       with:
-        aws-access-key-id: ${{ secrets.AWS_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET }}
-        aws-region: us-east-1
+        role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
+        aws-region: ${{ secrets.AWS_REGION }}
     - if: github.event_name == 'push' && github.ref == 'refs/heads/master'
       run: make sync-latest-docs-to-s3
     - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && (contains(github.ref, 'b') == false)