fix: skip credential check on output-env-credentials: false by kellertk · Pull Request #1778 · aws-actions/configure-aws-credentials (original) (raw)

changed the titlefix: skip credential check on output-env-credentials fix: skip credential check on output-env-credentials: false

May 14, 2026

kellertk added a commit that referenced this pull request

May 25, 2026

• Revert "chore: Update dist"

This reverts commit e8614cf.

• Revert "chore(deps): bump @aws-sdk/client-sts from 3.1045.0 to 3.1049.0 (#1782)"

This reverts commit 4684f47.

• Revert "chore: Update dist"

This reverts commit 48b8685.

• Revert "chore(deps-dev): bump @smithy/property-provider from 4.3.1 to 4.3.3 (#1783)"

This reverts commit fe6ad3a.

• Revert "chore: Update dist"

This reverts commit 2520c5e.

• Revert "chore(deps-dev): bump @aws-sdk/credential-provider-env (#1784)"

This reverts commit bc1093d.

• Revert "chore(deps-dev): bump @types/node from 25.7.0 to 25.9.0 (#1785)"

This reverts commit ffde832.

• Revert "chore: Update dist"

This reverts commit 707acd9.

• Revert "chore(deps): bump @smithy/node-http-handler from 4.7.1 to 4.7.3 (#1781)"

This reverts commit a7c33ae.

• Revert "chore: update README for additional claim support (#1779)"

This reverts commit 713aaab.

• Revert "chore: Update dist"

This reverts commit e6e8eba.

• Revert "fix: skip credential check on output-env-credentials: false (#1778)"

This reverts commit 58e7c47.

• Revert "chore: document forgejo compatibility (#1776)"

This reverts commit f35a7d7.

• Revert "chore: Update dist"

This reverts commit 3884f59.

• Revert "feat: add additional session tags by default (#1775)"

This reverts commit e0ba768.

• Revert "chore: Update dist"

This reverts commit 6795889.

• Revert "feat: expose run id in STS client user-agent (#1774)"

This reverts commit 29d1be3.

• Revert "chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 (#1773)"

This reverts commit ef734cc.

• Revert "chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#1772)"

This reverts commit 7521c55.

• Revert "chore: Update dist"

This reverts commit c0e2737.

• Revert "chore(deps): bump @smithy/node-http-handler from 4.6.1 to 4.7.1 (#1770)"

This reverts commit dbd503f.

• Revert "chore: Update dist"

This reverts commit 18a236f.

• Revert "chore(deps-dev): bump @smithy/property-provider from 4.2.14 to 4.3.1 (#1771)"

This reverts commit 1ab3150.

• Revert "chore(deps-dev): bump @vitest/coverage-v8 from 4.1.5 to 4.1.6 (#1768)"

This reverts commit 1fb495c.

• Revert "chore: Update dist"

This reverts commit 1e8fec8.

• Revert "chore(deps): bump @aws-sdk/client-sts from 3.1044.0 to 3.1045.0 (#1767)"

This reverts commit a388f23.

• Revert "chore: update documentation for environment workflows (#1766)"

This reverts commit 3f7e1b6.

• Revert "feat: add regex validation to role-session-name (#1765)"

This reverts commit e354499.

• Revert "chore: Update dist"

This reverts commit 958a80f.

• Revert "feat: add more retry logic and better logging (#1764)"

This reverts commit 540d0c1.

• Revert "chore: automate README version bumping (#1763)"

This reverts commit 07ada0f.

• Revert "chore: Update dist"

This reverts commit f8d4eb6.

• Revert "feat: support custom STS endpoints (#1762)"

This reverts commit 8d52d05.

• Revert "chore: Update dist"

This reverts commit 681892c.

• Revert "chore: configure codeql to ignore generated code (#1760)"

This reverts commit dc2353e.

• Revert "feat: Allow custom session tags to be passed when assuming a role (#1759)"

This reverts commit 61f50f6.

• Revert "chore: automatic major version tagging (#1565)"

This reverts commit c36525a.

• Revert "chore: bump unit test node version (#1758)"

This reverts commit 39d1702.

• Revert "chore(deps): bump @aws-sdk/client-sts from 3.1043.0 to 3.1044.0 (#1754)"

This reverts commit 4cfda40.

• Revert "chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 (#1756)"

This reverts commit 8856e12.

• Revert "chore(deps): bump @actions/core from 2.0.3 to 3.0.1 (#1746)"

This reverts commit 64d8e82.

• Revert "chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748)"

This reverts commit 78f374f.

kellertk added a commit that referenced this pull request

May 26, 2026

• chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748)

• chore(deps-dev): bump vitest from 3.2.4 to 4.1.5

Bumps vitest from 3.2.4 to 4.1.5.

• Release notes
• Commits

updated-dependencies:

• dependency-name: vitest dependency-version: 4.1.5 dependency-type: direct:development update-type: version-update:semver-major ...

Signed-off-by: dependabot[bot] support@github.com

• chore(deps-dev): update @vitest/coverage-v8

Bump @vitest/coverage-v8 to ^4.1.5 to match peer dependency, and move vi.mock('node:fs') calls to the top level of test files to reflect actual hoisting semantics required by vitest 4.x.

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tom Keller kellertk@amazon.com (cherry picked from commit 78f374f)

• chore(deps): bump @actions/core from 2.0.3 to 3.0.1 (#1746)

• chore(deps): bump @actions/core from 2.0.3 to 3.0.1

Bumps @actions/core from 2.0.3 to 3.0.1.

• Changelog
• Commits

updated-dependencies:

• dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ...

Signed-off-by: dependabot[bot] support@github.com

• chore: update test mocks for @actions/core ESM

@actions/core v3 ships as an ESM module with non-configurable exports, breaking vi.spyOn(). Switch to vi.mock('@actions/core') which intercepts at the module loader level.

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tom Keller kellertk@amazon.com (cherry picked from commit 64d8e82)

• chore(deps): bump @aws-sdk/client-sts from 3.1043.0 to 3.1044.0 (#1754)

Bumps @aws-sdk/client-sts from 3.1043.0 to 3.1044.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1042.0 dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 4cfda40)

• chore: bump unit test node version (#1758)

(cherry picked from commit 39d1702)

• chore: automatic major version tagging (#1565)

• Update release-please.yml to auto-update version tag

• chore: configure release-please auto floating tag

Co-authored-by: Tom Keller kellertk@amazon.com (cherry picked from commit c36525a)

• feat: Allow custom session tags to be passed when assuming a role (#1759)

• Add possibility to input custom session tags

• Use json for input to custom-tags, add documentation for custom-tags

• Add more examples

• Simplify example to avoid parse error

• Add input validation for custom tags

• Fix unit tests for custom-tags

• Add debugging message

• Skip failing test for now

• Build package

• Remove some unused validation for custom tags

• feat: add validation for custom session tags

Harden the custom-tags feature against misuse and misconfiguration:

• Validate input is a JSON object (reject arrays, primitives, null)
• Enforce STS tag constraints: key length (128), value length (256), allowed characters
• Reject nested object/array values that would silently stringify to '[object Object]'
• Block overriding default session tags (GitHub, Repository, Workflow, etc.)
• Enforce 50-tag session limit
• Warn when custom-tags used with OIDC or web identity
• Fix missing await on helpers test assertion
• Remove unused CUSTOM_TAGS_JSON_INPUTS fixture
• Normalize test mocking to vi.mocked() pattern

Co-authored-by: Sylvain Verly sylvain.verly@gmail.com (cherry picked from commit 61f50f6)

• chore: configure codeql to ignore generated code (#1760)

(cherry picked from commit dc2353e)

• feat: support custom STS endpoints (#1762)

Closes #1067. This is a advanced option and is not needed for most deployments.

(cherry picked from commit 8d52d05)

• chore: automate README version bumping (#1763)

Closes #1420.

(cherry picked from commit 07ada0f)

• feat: add more retry logic and better logging (#1764)

Wraps exportAccountId and validateCredentials calls in retryAndBackoff. Closes #1681. Adds a label parameter to retryAndBackoff for better info-level log messages.

(cherry picked from commit 540d0c1)

• feat: add regex validation to role-session-name (#1765)

Previously invalid role session names would get errors from the STS API instead of this action rejecting them, causing unnecessary retries. Now we check them and fail early.

Closes #1656. That FR recommended that we sanitize the name before sending to STS, but instead we error to not silently change the user's selected session name (avoiding the potential security sharp edge)

(cherry picked from commit e354499)

• chore: update documentation for environment workflows (#1766)

Closes #1238.

(cherry picked from commit 3f7e1b6)

• chore(deps): bump @aws-sdk/client-sts from 3.1044.0 to 3.1045.0 (#1767)

Bumps @aws-sdk/client-sts from 3.1044.0 to 3.1045.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1045.0 dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit a388f23)

• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.5 to 4.1.6 (#1768)

Bumps @vitest/coverage-v8 from 4.1.5 to 4.1.6.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.6 dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 1fb495c)

• chore(deps-dev): bump @smithy/property-provider from 4.2.14 to 4.3.1 (#1771)

Bumps @smithy/property-provider from 4.2.14 to 4.3.1.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/property-provider" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 1ab3150)

• chore(deps): bump @smithy/node-http-handler from 4.6.1 to 4.7.1 (#1770)

Bumps @smithy/node-http-handler from 4.6.1 to 4.7.1.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/node-http-handler" dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit dbd503f)

• chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#1772)

Bumps @biomejs/biome from 2.4.14 to 2.4.15.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@biomejs/biome" dependency-version: 2.4.15 dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 7521c55)

• chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 (#1773)

Bumps @types/node from 25.6.0 to 25.7.0.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@types/node" dependency-version: 25.7.0 dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit ef734cc)

• feat: expose run id in STS client user-agent (#1774)

• feat: expose run id in STS client user-agent

Closes #483. This commit modifies the user-agent string so that it includes the GITHUB_RUN_ID and the GITHUB_RUN_ATTEMPT, in the format typically used by the SDK. User agent strings are logged to CloudTrail, allowing users to correlate CloudTrail events with GHA runs. We took this approach instead of logging the ACCESS_KEY_ID as suggested in the issue to avoid logging sensitive information.

• feat: add github_action to ua string

(cherry picked from commit 29d1be3)

• feat: add additional session tags by default (#1775)

Closes #390. Note that 50 session tags are the AWS default, and this commit changes our default set from 7 tags to 15 tags. This commit includes logic to split the tags into "required" vs "overridable". Required tags are this action's previous defaults and could never be overridden. Overridable tags are the new set and can be overridden by custom-tags. The action will not add tags if the addition plus the required plus the user's custom tags exceed the AWS limit of 50 total tags. This ensures backwards compat for the tag additions.

(cherry picked from commit e0ba768)

• chore: document forgejo compatibility (#1776)

• chore: document forgejo compatibility

• chore: linting fixes

(cherry picked from commit f35a7d7)

• fix: skip credential check on output-env-credentials: false (#1778)

Closes #1554.

(cherry picked from commit 58e7c47)

• chore: update README for additional claim support (#1779)

• chore: update README for additional claim support

• chore: lint fix (whitespace)

(cherry picked from commit 713aaab)

• chore(deps): bump @smithy/node-http-handler from 4.7.1 to 4.7.3 (#1781)

Bumps @smithy/node-http-handler from 4.7.1 to 4.7.3.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/node-http-handler" dependency-version: 4.7.3 dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit a7c33ae)

• chore(deps-dev): bump @types/node from 25.7.0 to 25.9.0 (#1785)

Bumps @types/node from 25.7.0 to 25.9.0.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@types/node" dependency-version: 25.9.0 dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit ffde832)

• chore(deps-dev): bump @aws-sdk/credential-provider-env (#1784)

Bumps @aws-sdk/credential-provider-env from 3.972.34 to 3.972.38.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/credential-provider-env" dependency-version: 3.972.38 dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit bc1093d)

• chore(deps-dev): bump @smithy/property-provider from 4.3.1 to 4.3.3 (#1783)

Bumps @smithy/property-provider from 4.3.1 to 4.3.3.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/property-provider" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit fe6ad3a)

• chore(deps): bump @aws-sdk/client-sts from 3.1045.0 to 3.1049.0 (#1782)

Bumps @aws-sdk/client-sts from 3.1045.0 to 3.1049.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1049.0 dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 4684f47)

• chore: reconcile lockfile and test formatting

• chore: Update dist

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Michael Lehmann lehmanmj@amazon.com Co-authored-by: Sylvain Verly sylvain.verly@gmail.com

This was referenced

May 26, 2026

kellertk added a commit that referenced this pull request

May 28, 2026

• chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748)

• chore(deps-dev): bump vitest from 3.2.4 to 4.1.5

Bumps vitest from 3.2.4 to 4.1.5.

• Release notes
• Commits

updated-dependencies:

• dependency-name: vitest dependency-version: 4.1.5 dependency-type: direct:development update-type: version-update:semver-major ...

• chore(deps-dev): update @vitest/coverage-v8

Bump @vitest/coverage-v8 to ^4.1.5 to match peer dependency, and move vi.mock('node:fs') calls to the top level of test files to reflect actual hoisting semantics required by vitest 4.x.

(cherry picked from commit 78f374f)

• chore(deps): bump @actions/core from 2.0.3 to 3.0.1 (#1746)

• chore(deps): bump @actions/core from 2.0.3 to 3.0.1

Bumps @actions/core from 2.0.3 to 3.0.1.

• Changelog
• Commits

updated-dependencies:

• dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ...

• chore: update test mocks for @actions/core ESM

@actions/core v3 ships as an ESM module with non-configurable exports, breaking vi.spyOn(). Switch to vi.mock('@actions/core') which intercepts at the module loader level.

(cherry picked from commit 64d8e82)

• chore(deps): bump @aws-sdk/client-sts from 3.1043.0 to 3.1044.0 (#1754)

Bumps @aws-sdk/client-sts from 3.1043.0 to 3.1044.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1042.0 dependency-type: direct:production update-type: version-update:semver-minor ...

(cherry picked from commit 4cfda40)

• chore: bump unit test node version (#1758)

(cherry picked from commit 39d1702)

• chore: automatic major version tagging (#1565)

• Update release-please.yml to auto-update version tag

• chore: configure release-please auto floating tag

(cherry picked from commit c36525a)

• feat: Allow custom session tags to be passed when assuming a role (#1759)

• Add possibility to input custom session tags

• Use json for input to custom-tags, add documentation for custom-tags

• Add more examples

• Simplify example to avoid parse error

• Add input validation for custom tags

• Fix unit tests for custom-tags

• Add debugging message

• Skip failing test for now

• Build package

• Remove some unused validation for custom tags

• feat: add validation for custom session tags

Harden the custom-tags feature against misuse and misconfiguration:

• Validate input is a JSON object (reject arrays, primitives, null)
• Enforce STS tag constraints: key length (128), value length (256), allowed characters
• Reject nested object/array values that would silently stringify to '[object Object]'
• Block overriding default session tags (GitHub, Repository, Workflow, etc.)
• Enforce 50-tag session limit
• Warn when custom-tags used with OIDC or web identity
• Fix missing await on helpers test assertion
• Remove unused CUSTOM_TAGS_JSON_INPUTS fixture
• Normalize test mocking to vi.mocked() pattern

(cherry picked from commit 61f50f6)

• chore: configure codeql to ignore generated code (#1760)

(cherry picked from commit dc2353e)

• feat: support custom STS endpoints (#1762)

Closes #1067. This is a advanced option and is not needed for most deployments.

(cherry picked from commit 8d52d05)

• chore: automate README version bumping (#1763)

Closes #1420.

(cherry picked from commit 07ada0f)

• feat: add more retry logic and better logging (#1764)

Wraps exportAccountId and validateCredentials calls in retryAndBackoff. Closes #1681. Adds a label parameter to retryAndBackoff for better info-level log messages.

(cherry picked from commit 540d0c1)

• feat: add regex validation to role-session-name (#1765)

Previously invalid role session names would get errors from the STS API instead of this action rejecting them, causing unnecessary retries. Now we check them and fail early.

Closes #1656. That FR recommended that we sanitize the name before sending to STS, but instead we error to not silently change the user's selected session name (avoiding the potential security sharp edge)

(cherry picked from commit e354499)

• chore: update documentation for environment workflows (#1766)

Closes #1238.

(cherry picked from commit 3f7e1b6)

• chore(deps): bump @aws-sdk/client-sts from 3.1044.0 to 3.1045.0 (#1767)

Bumps @aws-sdk/client-sts from 3.1044.0 to 3.1045.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1045.0 dependency-type: direct:production update-type: version-update:semver-minor ...

(cherry picked from commit a388f23)

• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.5 to 4.1.6 (#1768)

Bumps @vitest/coverage-v8 from 4.1.5 to 4.1.6.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.6 dependency-type: direct:development update-type: version-update:semver-patch ...

(cherry picked from commit 1fb495c)

• chore(deps-dev): bump @smithy/property-provider from 4.2.14 to 4.3.1 (#1771)

Bumps @smithy/property-provider from 4.2.14 to 4.3.1.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/property-provider" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-minor ...

(cherry picked from commit 1ab3150)

• chore(deps): bump @smithy/node-http-handler from 4.6.1 to 4.7.1 (#1770)

Bumps @smithy/node-http-handler from 4.6.1 to 4.7.1.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/node-http-handler" dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-minor ...

(cherry picked from commit dbd503f)

• chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#1772)

Bumps @biomejs/biome from 2.4.14 to 2.4.15.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@biomejs/biome" dependency-version: 2.4.15 dependency-type: direct:development update-type: version-update:semver-patch ...

(cherry picked from commit 7521c55)

• chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 (#1773)

Bumps @types/node from 25.6.0 to 25.7.0.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@types/node" dependency-version: 25.7.0 dependency-type: direct:development update-type: version-update:semver-minor ...

(cherry picked from commit ef734cc)

• feat: expose run id in STS client user-agent (#1774)

• feat: expose run id in STS client user-agent

Closes #483. This commit modifies the user-agent string so that it includes the GITHUB_RUN_ID and the GITHUB_RUN_ATTEMPT, in the format typically used by the SDK. User agent strings are logged to CloudTrail, allowing users to correlate CloudTrail events with GHA runs. We took this approach instead of logging the ACCESS_KEY_ID as suggested in the issue to avoid logging sensitive information.

• feat: add github_action to ua string

(cherry picked from commit 29d1be3)

• feat: add additional session tags by default (#1775)

Closes #390. Note that 50 session tags are the AWS default, and this commit changes our default set from 7 tags to 15 tags. This commit includes logic to split the tags into "required" vs "overridable". Required tags are this action's previous defaults and could never be overridden. Overridable tags are the new set and can be overridden by custom-tags. The action will not add tags if the addition plus the required plus the user's custom tags exceed the AWS limit of 50 total tags. This ensures backwards compat for the tag additions.

(cherry picked from commit e0ba768)

• chore: document forgejo compatibility (#1776)

• chore: document forgejo compatibility

• chore: linting fixes

(cherry picked from commit f35a7d7)

• fix: skip credential check on output-env-credentials: false (#1778)

Closes #1554.

(cherry picked from commit 58e7c47)

• chore: update README for additional claim support (#1779)

• chore: update README for additional claim support

• chore: lint fix (whitespace)

(cherry picked from commit 713aaab)

• chore(deps): bump @smithy/node-http-handler from 4.7.1 to 4.7.3 (#1781)

Bumps @smithy/node-http-handler from 4.7.1 to 4.7.3.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/node-http-handler" dependency-version: 4.7.3 dependency-type: direct:production update-type: version-update:semver-patch ...

(cherry picked from commit a7c33ae)

• chore(deps-dev): bump @types/node from 25.7.0 to 25.9.0 (#1785)

Bumps @types/node from 25.7.0 to 25.9.0.

• Release notes
• Commits

updated-dependencies:

• dependency-name: "@types/node" dependency-version: 25.9.0 dependency-type: direct:development update-type: version-update:semver-minor ...

(cherry picked from commit ffde832)

• chore(deps-dev): bump @aws-sdk/credential-provider-env (#1784)

Bumps @aws-sdk/credential-provider-env from 3.972.34 to 3.972.38.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/credential-provider-env" dependency-version: 3.972.38 dependency-type: direct:development update-type: version-update:semver-patch ...

(cherry picked from commit bc1093d)

• chore(deps-dev): bump @smithy/property-provider from 4.3.1 to 4.3.3 (#1783)

Bumps @smithy/property-provider from 4.3.1 to 4.3.3.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@smithy/property-provider" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch ...

(cherry picked from commit fe6ad3a)

• chore(deps): bump @aws-sdk/client-sts from 3.1045.0 to 3.1049.0 (#1782)

Bumps @aws-sdk/client-sts from 3.1045.0 to 3.1049.0.

• Release notes
• Changelog
• Commits

updated-dependencies:

• dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1049.0 dependency-type: direct:production update-type: version-update:semver-minor ...

(cherry picked from commit 4684f47)

• chore: reconcile lockfile and test formatting

• chore: Update dist

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Michael Lehmann lehmanmj@amazon.com Co-authored-by: Sylvain Verly sylvain.verly@gmail.com

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters

[ Show hidden characters]({{ revealButtonHref }})