From 36e5c8f1b80be0f2a2bd8e540cca5601f54e9751 Mon Sep 17 00:00:00 2001 From: JD Harrington Date: Tue, 11 Aug 2026 15:18:28 -0400 Subject: [PATCH] Publish techdocs via OIDC instead of static AWS credentials The techdocs workflow no longer passes TRUSS_AWS_ACCESS_KEY_ID / TRUSS_AWS_SECRET_ACCESS_KEY to the Bridge Backstage Techdocs action. The action now assumes the github-truss IAM role via GitHub OIDC by default, so the workflow only needs to grant id-token: write. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/techdocs.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/techdocs.yaml b/.github/workflows/techdocs.yaml index 405a40c..d6cd545 100644 --- a/.github/workflows/techdocs.yaml +++ b/.github/workflows/techdocs.yaml @@ -13,6 +13,9 @@ on: jobs: publish-techdocs: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v5 with: @@ -22,8 +25,6 @@ jobs: ref: master - uses: ./.github/developer_portal/.github/actions/techdocs with: - aws_access_key_id: ${{ secrets.TRUSS_AWS_ACCESS_KEY_ID }} - aws_secret_access_key: ${{ secrets.TRUSS_AWS_SECRET_ACCESS_KEY }} aws_region: us-east-2 entity_name: 'scorm-engine' entity_kind: 'component'