From c2dcebc48bfc29dfea5f1a8941c07365e9ed4b99 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 25 Oct 2026 14:56:27 +0000 Subject: [PATCH] ci: skip AWS credential steps for pull requests from forks Fork PRs don't receive repo secrets or an OIDC token, so aws-actions/configure-aws-credentials fails with 'Could not load credentials from any providers'. Skip the AWS steps on fork runs (like we already do for dependabot) so the TEST_* env vars stay unset and the AWS-dependent tests skip themselves cleanly. Co-authored-by: Mike Heffner --- .github/workflows/ci.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ccfcb4d..96a909e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,15 +37,19 @@ jobs: target: ${{ matrix.target }} rustflags: "" - # dependabot does not have access to secrets, skip for dependency updates + # Skip the AWS steps when secrets are unavailable: dependabot runs and + # pull requests from forks get neither repo secrets nor an OIDC token, + # so assuming the CI role would fail. The TEST_* env vars must also stay + # completely unset (not set to empty) so the AWS-dependent tests skip + # themselves cleanly. - name: Configure AWS credentials - if: ${{ github.actor != 'dependabot[bot]' }} + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.fork != true }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_LAMBDA_CI_ROLE_ARN }} aws-region: us-east-1 - name: Set secret test ARNS - if: ${{ github.actor != 'dependabot[bot]' }} + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.fork != true }} run: | echo "TEST_SECRETSMANAGER_ARNS=${{ secrets.TEST_SECRETSMANAGER_ARNS }}" >> $GITHUB_ENV echo "TEST_PARAMSTORE_ARNS=${{ secrets.TEST_PARAMSTORE_ARNS }}" >> $GITHUB_ENV