sessionwiki

Session: github-actions-oidc-deploy — 2026-09-14

infra-stack · Copilot · branch feat/oidc-deploy · gpt-5 · 2026-09-14 13:20 · 1 msgs · 3 tools · 1 min read · updated 7 weeks ago

tools: Bash, Edit, Write
← infra-stack Download .md .txt .json
Tool calls
Bash Bash: 1 call (33.3%) 1 Edit Edit: 1 call (33.3%) 1 Write Write: 1 call (33.3%) 1
Token usage61.6K total
Input6.6K
Cache creation13.2K
Cache read39.6K
Output2.2K
Cache hit ratio67%· warming up

Project: infra-stack · Branch: feat/oidc-deploy · Mode: default · Model: gpt-5

Summary

Replaced long-lived AWS keys in CI with GitHub Actions OIDC: an IAM role trusted only for this repo's main branch and environment, scoped to the deploy bucket and the EKS cluster.

Conversation

Turn 1 — User

Get rid of the AWS access keys in our GitHub secrets.

Turn 1 — Assistant

Create an OIDC provider and a role whose trust policy pins repo:<org>/infra-stack:environment:prod. The workflow uses aws-actions/configure-aws-credentials with role-to-assume.

Tools used in this turn:

  • Write: iam/github-oidc.tf
  • Edit: .github/workflows/deploy.yml
  • Bash: terraform apply -target=module.github_oidc — 3 added

Connections

  • [[infra-stack]]
  • [[GitHubActions]]
  • [[OIDC]]
  • [[LeastPrivilege]]

Keyboard shortcuts

⌘K / Ctrl+KOpen command palette
/Focus search
g hGo to home
g pGo to projects
g sGo to sessions
j / kNext / prev row (tables)
?Show this help
EscClose dialogs

Structured queries

Mix key:value filters with free text in the palette:

type:sessionOnly session pages
project:llm-wikiFilter by project name (substring)
model:claudeFilter by model name (substring)
date:>2026-03-01Sessions after a date
date:<2026-04-01Sessions before a date
tags:rustPages mentioning a tag/topic
sort:dateSort results by date (newest first)

Example: type:session project:llm-wiki date:>2026-04 sort:date