From a7eaac2ec04ff589e52d745d9cc19a8c375f7f8d Mon Sep 17 00:00:00 2001
From: Tony Knopp <tknopp@launchdarkly.com>
Date: Fri, 14 Aug 2026 13:40:13 -0400
Subject: [PATCH] [Cursor] fix: fail fast when AWS_ROLE_ARN is unset

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/publish-image.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 341fbb67..8bdebc60 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -58,6 +58,14 @@ jobs:
         with:
           ref: ${{ steps.version.outputs.git_tag }}
 
+      - name: Require AWS_ROLE_ARN
+        run: |
+          set -euo pipefail
+          if [[ -z "${{ vars.AWS_ROLE_ARN }}" ]]; then
+            echo "::error::Missing Actions variable AWS_ROLE_ARN. Set it on this repository to the same release role used by ld-find-code-refs (OIDC must trust launchdarkly/find-code-references-in-pull-request)."
+            exit 1
+          fi
+
       - name: Get Docker Hub credentials
         uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
         with: