From c70fae79b869a126505f60c685076f2cb01c13af Mon Sep 17 00:00:00 2001 From: Blair Hamilton Date: Sun, 5 Jul 2026 17:32:57 -0400 Subject: [PATCH] fix(docker-release): derive the repo-level push role by convention MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secrets.AWS_ROLE_ARN does not exist (org or repo) — the pre-stevedore matrix never exercised the fallback because discover-services supplied per-service roles, so the stevedore single job failed its AssumeRole with "Credentials could not be loaded" on trading's first run. Default to arn:aws:iam::784682930591:role/xp--gha-push from the caller repo name (the repo-level role convention; trading's already exists), keeping the secret as an explicit override. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-release.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index f391795..81b42aa 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -95,10 +95,13 @@ jobs: - name: Configure AWS credentials uses: pinpredict/.github/actions/configure-aws-with-retry@main with: - # Single-job builds push every image under the central role. The - # per-service xp--gha-push roles are a matrix-mode feature - # (stevedore plan + release --only) — see the workflow header. - role-to-assume: ${{ secrets.AWS_ROLE_ARN }} + # Single-job builds push every image under the caller repo's + # repo-level role xp--gha-push (ECR push on the repo's + # image namespace), derived by convention; secrets.AWS_ROLE_ARN + # overrides when set. The per-service xp--gha-push roles + # are a matrix-mode feature (stevedore plan + release --only) — + # see the workflow header. + role-to-assume: ${{ secrets.AWS_ROLE_ARN || format('arn:aws:iam::784682930591:role/xp-{0}-gha-push', github.event.repository.name) }} aws-region: ${{ env.AWS_REGION }} - name: Log in to Amazon ECR