[skip-changelog] use OIDC to retrieve the credentials

arduino / arduino-cli

Arduino command line tool

GNU General Public License v3.0

4.24k stars 371 forks source link

Please check if the PR fulfills these requirements

See how to contribute

[X] The PR has no duplicates (please search among the Pull Requests before creating one)
[X] The PR follows our contributing guidelines ~~- [ ] Tests for the changes have been added (for bug fixes / features)~~ ~~- [ ] Docs have been added / updated (for bug fixes / features)~~ ~~- [ ] UPGRADING.md has been updated with a migration guide (for breaking changes)~~ ~~- [ ] configuration.schema.json updated if new parameters are added.~~

What kind of change does this PR introduce?

infra change

What is the current behavior?

We currently use statically generated credentials to access to s3 buckets.

What is the new behavior?

OpenID Connect allows workflows to exchange short-lived tokens directly from your cloud provider (see here)

Does this PR introduce a breaking change, and is titled accordingly?

Other information

[x] TODO remove AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from secrets
[x] TODO add AWS_ROLE_TO_ASSUME to secrets

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (20b9ba1) 69.37% compared to head (1e0d26e) 69.39%.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #2541 +/- ## ========================================== + Coverage 69.37% 69.39% +0.01% ========================================== Files 203 203 Lines 20149 20149 ========================================== + Hits 13978 13982 +4 + Misses 5048 5045 -3 + Partials 1123 1122 -1 ``` | [Flag](https://app.codecov.io/gh/arduino/arduino-cli/pull/2541/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=arduino) | Coverage Δ | | |---|---|---| | [unit](https://app.codecov.io/gh/arduino/arduino-cli/pull/2541/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=arduino) | `69.39% <ø> (+0.01%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=arduino#carryforward-flags-in-the-pull-request-comment) to find out more.

arduino / arduino-cli