gha-oidc-patterns

Use aws-actions/configure-aws-credentials@v4 with OIDC token exchange. This official action replaces curl|sh anti-patterns by leveraging GitHub's id-token write permission to establish a secure, identity-federated connection to AWS without storing long-lived credentials.

OIDC (OpenID Connect) enables token-based identity federation between GitHub and cloud services. It eliminates the need for static secrets, provides role-based access control, and allows GitHub Actions to assume temporary credentials directly from your cloud provider using cryptographically signed tokens.

Yes. Official OIDC-enabled actions support coordinating AWS login, Pulumi Cloud ESC authentication, and ECR/ECS deployment in a single multi-step workflow. Each step exchanges the GitHub id-token for provider-specific credentials, minimizing secret handling across all deployment targets.

Use Pulumi's official OIDC action to authenticate to ESC, then reference its configuration outputs directly in subsequent workflow steps. This approach centralizes secrets and settings in ESC while GitHub Actions retrieves them on-demand during deployment without storing them as repository secrets.

Add `id-token: write` permission to your workflow's `permissions` block. This allows GitHub Actions to request and sign OIDC tokens from the GitHub OIDC provider, which your cloud provider then validates to issue temporary credentials for your job.

Yes. Official actions support OIDC-based ECR login and ECS task execution. After authenticating via OIDC to AWS, subsequent steps can push images to ECR and deploy to ECS using the temporary credentials obtained through token exchange, all within a single secure workflow.