fix(docker-release): derive the repo-level push role by convention#42
Merged
Conversation
secrets.AWS_ROLE_ARN does not exist (org or repo) — the pre-stevedore matrix never exercised the fallback because discover-services supplied per-service roles, so the stevedore single job failed its AssumeRole with "Credentials could not be loaded" on trading's first run. Default to arn:aws:iam::784682930591:role/xp-<repo>-gha-push from the caller repo name (the repo-level role convention; trading's already exists), keeping the secret as an explicit override. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trading's first stevedore run (post pinpredict/trading#1970) failed at Configure AWS credentials with
Credentials could not be loaded—secrets.AWS_ROLE_ARNdoesn't exist at org or repo level. The pre-stevedore matrix never hit that fallback because every matrix entry carried its per-servicexp-<svc>-gha-pushrole; the single-job stevedore workflow is the first consumer of repo-level credentials.Fix: default
role-to-assumetoarn:aws:iam::784682930591:role/xp-<caller-repo>-gha-push(the existing repo-level role convention —xp-trading-gha-pushexists), withsecrets.AWS_ROLE_ARNkept as an explicit override.xp-trading-gha-pushcurrently has no policies (its 22-repo ECR policy lived in trading's retired.platform/manifests/tree and was pruned when trading moved to per-service yamls). It needs an ECR push/describe policy onrepository/trading/*before the run can succeed — tracked separately.🤖 Generated with Claude Code