Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add CI OIDC access to new bors branches #355

Merged
merged 4 commits into from
Mar 9, 2024
Merged

Add CI OIDC access to new bors branches #355

merged 4 commits into from
Mar 9, 2024

Commits on Mar 9, 2024

  1. Bring rustc-ci in sync with latest terraform

    @Mark-Simulacrum
    Mark-Simulacrum committed Mar 9, 2024
    Configuration menu
    Copy the full SHA
    1fd1db9 View commit details
    Browse the repository at this point in the history

  2. Add access for new bors to PUT into artifacts bucket 

    This grants access under a new directory prefix (rustc-builds-try) as a
temporary measure to avoid mistakes overwriting any actual artifacts. It
might be a good idea in any case to scope try builds into a different
bucket or place than real builds.
    @Mark-Simulacrum
    Mark-Simulacrum committed Mar 9, 2024
    Configuration menu
    Copy the full SHA
    2160c87 View commit details
    Browse the repository at this point in the history

  3. Limit write access to specific prefix 

    This uses Cognito as a dispatch authority to convert OIDC claims to IAM
condition values, and then fitlers the resulting role to only writing
into the passed sha.

See https://awsteele.com/blog/2023/10/25/aws-role-session-tags-for-github-actions.html for some related context.
    @Mark-Simulacrum
    Mark-Simulacrum committed Mar 9, 2024
    Configuration menu
    Copy the full SHA
    2f7aefc View commit details
    Browse the repository at this point in the history

  4. Revert "Limit write access to specific prefix" 

    See write up here:
rust-lang#355 (comment).
We decided not to pursue this for the time being and revisit at a later
point.

This reverts commit 2f7aefc.
    @Mark-Simulacrum
    Mark-Simulacrum committed Mar 9, 2024
    Configuration menu
    Copy the full SHA
    ac858b7 View commit details
    Browse the repository at this point in the history