From 4bc674316f4a9dcc6b46e3a2d3516b6a23f1d1f0 Mon Sep 17 00:00:00 2001 From: Nicolas Borges Date: Tue, 3 Nov 2026 10:53:52 -0500 Subject: [PATCH] chore(ci): pin CLI references to hardened devtools --- .github/workflows/canary-v0.yml | 4 ++-- .github/workflows/canary.yml | 2 +- .github/workflows/e2e-test.yml | 6 +++--- .github/workflows/pr-automation.yml | 10 +++++----- .github/workflows/slack-issue-notification.yml | 2 +- .github/workflows/slack-open-prs-notification.yml | 2 +- .github/workflows/workflow-metrics.yml | 2 +- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/canary-v0.yml b/.github/workflows/canary-v0.yml index d2867fa14c..9a5bb30817 100644 --- a/.github/workflows/canary-v0.yml +++ b/.github/workflows/canary-v0.yml @@ -60,7 +60,7 @@ jobs: git config --global user.name "CI" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 - name: Fetch E2E role from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: E2E_AWS_ROLE_ARN @@ -96,7 +96,7 @@ jobs: with: persist-credentials: false - name: Fetch E2E role from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: E2E_AWS_ROLE_ARN diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index c3e23c0f95..1d452fc6ae 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -62,7 +62,7 @@ jobs: with: persist-credentials: false - name: Fetch E2E role from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: E2E_AWS_ROLE_ARN diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 251d5bcba0..3eb08e6dae 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -57,13 +57,13 @@ jobs: is-authorized: ${{ github.workflow == 'canary' || steps.check.outputs.is_authorized == 'true' }} steps: - name: Fetch secrets from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: AUTHORIZED_USERS - name: Check authorization id: authz - uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74 + uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: subject: ${{ github.actor }} authorized-users: ${{ env.AUTHORIZED_USERS }} @@ -115,7 +115,7 @@ jobs: python-version: "3.14" - run: bun install --frozen-lockfile - name: Fetch E2E role from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@75989f65f7f193deaf83c237c36572d1a8f800b2 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: E2E_AWS_ROLE_ARN diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml index 1c7c3f390c..a9ba74d087 100644 --- a/.github/workflows/pr-automation.yml +++ b/.github/workflows/pr-automation.yml @@ -25,7 +25,7 @@ jobs: contents: read pull-requests: write statuses: write - uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-size-title.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab + uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-size-title.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: runner: codebuild secrets: inherit @@ -42,7 +42,7 @@ jobs: pull-requests: write issues: write contents: read - uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-security-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506 + uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-security-review.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: runner: codebuild pr_number: ${{ inputs.pr_number || format('{0}', github.event.pull_request.number) }} @@ -61,7 +61,7 @@ jobs: pull-requests: write issues: write contents: read - uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-ai-review.yml@4b3972e790e4cc312ddf6f1909a0b6ca8a749506 + uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-ai-review.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: runner: codebuild model_id: us.anthropic.claude-opus-5 @@ -124,13 +124,13 @@ jobs: echo "author=$author" >> "$GITHUB_OUTPUT" echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT" - name: Fetch secrets from Secrets Manager - uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74 + uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }} repo: AUTHORIZED_USERS - name: Check authorization id: authz - uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@31aa3b031a86664e29861d68956e44b07cf21a74 + uses: aws/agentcore-devx-devtools/.github/actions/check-authorized-user@e68d09b0c33dfb7a798448d50e6b48beedf00a3b with: subject: ${{ steps.pr.outputs.author }} authorized-users: ${{ env.AUTHORIZED_USERS }} diff --git a/.github/workflows/slack-issue-notification.yml b/.github/workflows/slack-issue-notification.yml index eb229c2ffd..5daf584981 100644 --- a/.github/workflows/slack-issue-notification.yml +++ b/.github/workflows/slack-issue-notification.yml @@ -14,7 +14,7 @@ permissions: jobs: call: - uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-issue-notification.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab + uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-issue-notification.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: runner: codebuild secrets: inherit diff --git a/.github/workflows/slack-open-prs-notification.yml b/.github/workflows/slack-open-prs-notification.yml index f600a839e5..de85fc36d2 100644 --- a/.github/workflows/slack-open-prs-notification.yml +++ b/.github/workflows/slack-open-prs-notification.yml @@ -12,7 +12,7 @@ permissions: jobs: call: - uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-open-prs-notification.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab + uses: aws/agentcore-devx-devtools/.github/workflows/reusable-slack-open-prs-notification.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: runner: codebuild secrets: inherit diff --git a/.github/workflows/workflow-metrics.yml b/.github/workflows/workflow-metrics.yml index e98c44d3dd..f34293f1b4 100644 --- a/.github/workflows/workflow-metrics.yml +++ b/.github/workflows/workflow-metrics.yml @@ -9,7 +9,7 @@ permissions: jobs: metrics: - uses: aws/agentcore-devx-devtools/.github/workflows/workflow-metrics.yml@d145deb62f1adc8be63fa4879a488499e1128a46 + uses: aws/agentcore-devx-devtools/.github/workflows/workflow-metrics.yml@c2106996dd94e56f6c5fad625c83573e9724fb63 with: namespace: AgentCoreCLI/Workflows os: Linux