Pin configure-aws-credentials to a SHA and bump to v6.2.3 - #542
Merged
Conversation
v4 is the last Node 20 deprecation warning on this workflow. v6's only breaking change is requiring a Node 24 runner, which ubuntu-latest already forces — that is what the warning was about. v5's only breaking change was invalid boolean input handling, and this step passes no boolean inputs. Pinned by commit SHA rather than tag. Tags are mutable, and this is the step that mints AWS credentials, so a moved tag would be an unreviewed change to what can assume the upload role. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dopey
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #541. Clears the last Node 20 deprecation warning on
Upload Assetsand pins the action by commit SHA.Why SHA-pinned
Tags are mutable. This is the step that mints AWS credentials, so a moved tag would silently change what can assume the upload role — an unreviewed change to the trust path. The SHA is verified as the v6.2.3 release commit (
chore(main): release 6.2.3, committed 33s before the release was published).Why the bump is safe
Two majors, one relevant breaking change each, neither of which applies:
role-to-assumeandaws-region; no booleans.ubuntu-latestalready forces Node 24, which is precisely what the deprecation warning says.Verification
dry_runcannot test this — it skips the credentials step entirely. After merge this needs oneworkflow_dispatchwithfull_sync=trueto exercise OIDC for real. Idempotent: re-uploads and re-purges the same 128 graphics, and repeat purges inside imgix's 10s window return 409, which the workflow already treats as success.actions/checkout@v5is left on a tag. Happy to pin it too if we want that as a repo-wide convention rather than a rule for credential-minting steps only.🤖 Generated with Claude Code