From ca7145e60907f1b951116b19bd0cb9a8cc3c7aed Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 11:59:38 -0500 Subject: [PATCH 1/4] chore: upgrade actions to Node 24 runtime (SHA-pinned) --- .github/workflows/lambda.yml | 8 ++++---- .github/workflows/validate-codeowners.yml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 9c6a819..481f8d4 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -28,7 +28,7 @@ jobs: # Setup GHA Dependencies ################################################## - name: Use Node.js 16.x - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 16.x @@ -40,7 +40,7 @@ jobs: # Checkout the repository ################################################## - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -70,7 +70,7 @@ jobs: ################################################## - name: Metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: dummy tags: | @@ -98,7 +98,7 @@ jobs: mv "./$FILE_NAME" "$GITHUB_WORKSPACE/$FILE_NAME" - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: aws-region: us-east-2 role-to-assume: ${{ env.IAM_ROLE_ARN_S3 }} diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index dd0723d..1dfaf44 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code at current commit" - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: mszostok/codeowners-validator@v0.5.0 if: github.event.pull_request.head.repo.full_name == github.repository name: "Full check of CODEOWNERS" From 06c65211c9a47ea6189850ca64c628b70e226d7f Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:29:57 -0500 Subject: [PATCH 2/4] fix: correct IAM_ROLE_SESSION_NAME env var typo --- .github/workflows/lambda.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 481f8d4..5603854 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -16,7 +16,7 @@ permissions: env: AWS_REGION: us-east-1 IAM_ROLE_ARN_S3: arn:aws:iam::847349463865:role/cplive-core-ue2-public-lambda-artifacts-gha - IAM_ROLE_SEESION_NAME: cloudposse/token-rotator/ci + IAM_ROLE_SESSION_NAME: cloudposse/token-rotator/ci S3_BUCKET: cplive-core-ue2-public-lambda-artifacts S3_FOLDER: lambda-github-action-token-rotator From 413501d96f7cb90f2494698b1d5a70e2d1fd4454 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:31:33 -0500 Subject: [PATCH 3/4] fix: make role session name satisfy AWS pattern --- .github/workflows/lambda.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 5603854..7b17e9d 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -16,7 +16,7 @@ permissions: env: AWS_REGION: us-east-1 IAM_ROLE_ARN_S3: arn:aws:iam::847349463865:role/cplive-core-ue2-public-lambda-artifacts-gha - IAM_ROLE_SESSION_NAME: cloudposse/token-rotator/ci + IAM_ROLE_SESSION_NAME: cloudposse-token-rotator-ci S3_BUCKET: cplive-core-ue2-public-lambda-artifacts S3_FOLDER: lambda-github-action-token-rotator From c39ef087585640e9ef9a292d51193f23e00197c2 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:38:33 -0500 Subject: [PATCH 4/4] fix: use shared codeowners workflow for org team validation --- .github/workflows/validate-codeowners.yml | 28 +++++++---------------- 1 file changed, 8 insertions(+), 20 deletions(-) diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index 1dfaf44..b9272b7 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -4,24 +4,12 @@ on: pull_request: +permissions: + contents: read + jobs: - validate-codeowners: - runs-on: ubuntu-latest - steps: - - name: "Checkout source code at current commit" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: mszostok/codeowners-validator@v0.5.0 - if: github.event.pull_request.head.repo.full_name == github.repository - name: "Full check of CODEOWNERS" - with: - # For now, remove "files" check to allow CODEOWNERS to specify non-existent - # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos - # checks: "files,syntax,owners,duppatterns" - checks: "syntax,owners,duppatterns" - # GitHub access token is required only if the `owners` check is enabled - github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" - - uses: mszostok/codeowners-validator@v0.5.0 - if: github.event.pull_request.head.repo.full_name != github.repository - name: "Syntax check of CODEOWNERS" - with: - checks: "syntax,duppatterns" + ci-codeowners: + uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main + with: + is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + secrets: inherit