feat(changelog/bundle-upload): add optional aws-role-arn input - #314
Merged
Conversation
Adds an `aws-role-arn` input to the bundle-upload action. When set, the specified IAM role is assumed directly via aws-actions/configure-aws-credentials (SHA-pinned), bypassing the `aws/auth` repo-derived role derivation. When empty, existing behaviour is unchanged. Use case: docs-internal-workflows hosts a promotion workflow (`changelog-promotion-bundle.yml`) that uploads to the `bundle/` prefix in the private S3 bucket. That workflow runs in a GH Environment (`changelog-promotion-prod`) and needs to assume a single dedicated, narrowly-scoped role provisioned in docs-infra — not a role derived from the caller's repository SHA. Passing the role ARN explicitly avoids adding `elastic/docs-internal-workflows` to the shared `repositories.yml` list. Existing callers (per-product entry-upload workflows) pass no `aws-role-arn` and continue to get the repo-derived role as before. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
reakaleek
approved these changes
Sep 1, 2026
| env: | ||
| AWS_ROLE_ARN: ${{ inputs.aws-role-arn }} | ||
| run: | | ||
| if [[ -n "${AWS_ROLE_ARN}" ]]; then |
Member
There was a problem hiding this comment.
is this validation really needed?
I would say the aws-action/configure-awscredentials action catches this and might have a more detailed error message (maybe).
Member
Author
There was a problem hiding this comment.
Agreed and done — removed in a5a8a75. configure-aws-credentials already validates the ARN and surfaces a clearer error; the pre-flight check was redundant.
configure-aws-credentials already validates the ARN and produces a clear error on failure. The pre-flight check was an early-exit convenience with no correctness benefit — removing it keeps the action lean. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an optional
aws-role-arninput tochangelog/bundle-upload/action.yml.When set: the specified IAM role is assumed directly via
aws-actions/configure-aws-credentials(SHA-pinned at the existing pin), skipping theaws/authrepo-derived role derivation.When empty (default): behaviour is unchanged — existing per-product entry-upload callers are unaffected.
Why
The
changelog-promotion-bundle.ymlworkflow lives inelastic/docs-internal-workflows(a private repo). It needs to assume a single dedicated IAM role scoped to thebundle/prefix of the private S3 bucket. That role is provisioned standalone inelastic/docs-infrawith a trust policy pinned toelastic/docs-internal-workflows:environment:changelog-promotion-prod— not derived from a repository SHA.Without this input, the workflow would need to add
elastic/docs-internal-workflowsto the sharedrepositories.ymllist (100-entry, bucket-wide) — which is the wrong blast radius.Changes
changelog/bundle-upload/action.yml:aws-role-arn(empty default)if:conditions — explicit role path and the existing repo-derived path; exactly one runs per invocationTest plan
aws-role-arnis absent from call sites — no behaviour change expectedconfigure-aws-credentialsstep runs (notaws/auth), and the call succeeds in thechangelog-promotion-prodenvironment🤖 Generated with Claude Code