continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(ci): replace configure-aws-credentials with direct env vars
acdl-ci / Lint (pull_request) Successful in 7s
Details
acdl-ci / Test (pull_request) Successful in 4m3s
Details
acdl-ci / Platform check-only (offline) (pull_request) Successful in 20s
Details
acdl-modules-lifecycle / Platform VPC apply (pull_request) Failing after 19s
Details
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / Platform VPC destroy (pull_request) Failing after 18s
Details

Browse Source 
The aws-actions/configure-aws-credentials@v4 action failed on the Gitea
runner with 'Credentials could not be loaded' — the action couldn't
load the secrets in the Gitea Actions context. Replaced with direct
env var exports (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
AWS_DEFAULT_REGION) on each step that needs AWS access. This is simpler
and works reliably with Gitea Actions.

Also removed the id-token: write permission (not needed without the
configure-aws-credentials action's OIDC flow).

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
This commit is contained in:
Jon Chery
2026-07-28 16:31:09 +00:00
parent 75b56f5245
commit 315a86d396
2 changed files with 48 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/modules-lifecycle.yml
+24 -18
View File
@@ -17,7 +17,6 @@ on:
workflow_dispatch:
permissions:
id-token: write
contents: read
jobs:
@@ -36,13 +35,16 @@ jobs:
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: us-east-1
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
run: |
echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV
- name: Apply platform VPC
working-directory: terraform/platform
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform apply -auto-approve -lock=false
@@ -68,17 +70,23 @@ jobs:
wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: us-east-1
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
- name: Apply (simple)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
- name: Modify (complex)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
- name: Destroy
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
# Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
@@ -97,14 +105,12 @@ jobs:
wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: us-east-1
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
- name: Destroy platform VPC
working-directory: terraform/platform
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform destroy -auto-approve -lock=false