From 3fcc3d4a2058c91f0d0eb4d682d0bd69bd050a64 Mon Sep 17 00:00:00 2001 From: Kirk Bateman Date: Mon, 21 Sep 2026 10:13:37 +0100 Subject: [PATCH] guard AWS credential steps against pull_request runs Configure AWS credentials and Login to Amazon ECR were executed on every workflow run, including pull_request events, even though no image or chart is actually pushed on a PR. This unnecessarily minted an OIDC token and assumed the ECR IAM role on runners executing PR-controlled code. Gate both steps on the same condition that controls the actual publish: inputs.publish for artifacts.yaml, and a tag-push check for helm.yml. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/artifacts.yaml | 4 ++++ .github/workflows/helm.yml | 2 ++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index 3cf9805..e6b995c 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -72,6 +72,7 @@ jobs: syft-version: v0.76.1 - name: Configure AWS credentials + if: inputs.publish uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ vars.AWS_ECR_IAM_ROLE }} @@ -79,6 +80,7 @@ jobs: - name: Login to Amazon ECR id: login-ecr + if: inputs.publish uses: aws-actions/amazon-ecr-login@v2 - name: Set image name @@ -233,6 +235,7 @@ jobs: syft-version: v0.76.1 - name: Configure AWS credentials + if: inputs.publish uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ vars.AWS_ECR_IAM_ROLE }} @@ -240,6 +243,7 @@ jobs: - name: Login to Amazon ECR id: login-ecr + if: inputs.publish uses: aws-actions/amazon-ecr-login@v2 - name: Set image name diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index ddfad97..f6f7f79 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -29,6 +29,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Configure AWS credentials + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/deploy/charts/v') uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ vars.AWS_ECR_IAM_ROLE }} @@ -36,6 +37,7 @@ jobs: - name: Login to Amazon ECR id: login-ecr + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/deploy/charts/v') uses: aws-actions/amazon-ecr-login@v2 - name: Add Helm repositories