From 203d256b61edbdd6b97daa6b0beb3cd938b352fe Mon Sep 17 00:00:00 2001 From: JD Harrington Date: Wed, 19 Aug 2026 10:37:02 -0400 Subject: [PATCH] Update bootstrap template to use OIDC for ECR auth Replace static TRUSS_AWS env vars + ecr-auth action with aws-actions/configure-aws-credentials (OIDC) + amazon-ecr-login in the default bootstrap template documentation. Co-Authored-By: Claude Opus 4.6 (1M context) --- bootstrap-templates/default/README.md | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/bootstrap-templates/default/README.md b/bootstrap-templates/default/README.md index 7de82fa..d739e35 100644 --- a/bootstrap-templates/default/README.md +++ b/bootstrap-templates/default/README.md @@ -188,23 +188,21 @@ jobs: build-image: name: Build & Deploy runs-on: ubuntu-latest - env: - ECR_AWS_ACCESS_KEY_ID: {{ "${{ secrets.TRUSS_AWS_ACCESS_KEY_ID }}" }} - ECR_AWS_SECRET_ACCESS_KEY: {{ "${{ secrets.TRUSS_AWS_SECRET_ACCESS_KEY }}" }} - ECR_AWS_DEFAULT_REGION: us-east-2 + permissions: + id-token: write + contents: read steps: - name: Checkout repo - uses: actions/checkout@v3 + uses: actions/checkout@v4 - - name: Checkout actions repo - uses: actions/checkout@v3 + - name: Configure AWS credentials (OIDC) + uses: aws-actions/configure-aws-credentials@v4 with: - repository: get-bridge/actions - token: {{ "${{ secrets.GIT_HUB_TOKEN }}" }} - path: .github/actions + role-to-assume: arn:aws:iam::127178877223:role/github/github-truss + aws-region: us-east-2 - name: Login to ECR - uses: ./.github/actions/ecr-auth + uses: aws-actions/amazon-ecr-login@v2 - uses: docker/build-push-action@v3 env: