chore(amazonq): authenticate agentic-chat E2E tests via a dedicated OIDC role#2789
Open
laileni-aws wants to merge 2 commits into
Open
chore(amazonq): authenticate agentic-chat E2E tests via a dedicated OIDC role#2789laileni-aws wants to merge 2 commits into
laileni-aws wants to merge 2 commits into
Conversation
…chat E2E tests Short-term Flare fix: re-point the q-agentic-chat-server integration tests at the DEXP-owned SSOTokenSecret in the gamma-IAD canary account, replacing the removed Blueshift QnetTransformTokenRefresher. - Configure AWS Credentials now assumes the least-privilege OIDC read role arn:aws:iam::550160095699:role/LanguageServersGitHubActionsReadRole (us-east-1). - Remove the 'Refresh Token' lambda-invoke step; the canary SSORefreshTokenLambda refreshes SSOTokenSecret every ~5 min. - Replace 'Get SSO Token' with a raw GetSecretValue + jq extraction of the canaryGammaIAD accessToken into TEST_SSO_TOKEN, masked via ::add-mask::. - Tag traffic with AWS_SDK_UA_APP_ID=lsp-integ-ci for dashboard/BI segmentation. DO NOT MERGE yet: depends on the OIDC role deploying (canary CR-290695975), AppSec sign-off, and repo secrets TEST_SSO_START_URL + TEST_PROFILE_ARN.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2789 +/- ##
==========================================
- Coverage 60.20% 60.06% -0.15%
==========================================
Files 281 281
Lines 71191 71191
Branches 4575 4549 -26
==========================================
- Hits 42861 42758 -103
- Misses 28241 28345 +104
+ Partials 89 88 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
laileni-aws
marked this pull request as ready for review
July 20, 2026 21:10
xinyiww1
approved these changes
Jul 20, 2026
Point TEST_SSO_START_URL / TEST_PROFILE_ARN at new repo secrets INTEG_TEST_SSO_START_URL / INTEG_TEST_PROFILE_ARN instead of the existing TEST_SSO_START_URL / TEST_PROFILE_ARN (the env var names the test reads are unchanged; only the secret source moves). The old secrets still feed the current QnetTransform-based workflow, so overwriting them would risk breaking the currently-passing tests and they are unrecoverable once QnetTransform is torn down. New names keep old and new isolated and preserve a clean rollback: reverting this PR restores the old workflow + old secrets, which still work while QnetTransform is alive.
| with: | ||
| role-to-assume: arn:aws:iam::964765661569:role/GitHubActionsTokenRefresherRole | ||
| role-session-name: language-servers-github | ||
| # DEXP-owned GitHub-OIDC read role in the gamma-IAD canary account (550160095699): |
Contributor
There was a problem hiding this comment.
Don't think we should mention accounts on open source PRs
Contributor
Author
There was a problem hiding this comment.
Its fine we do mention this even before!
ashishrp-aws
requested changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Re-point the
q-agentic-chat-serverintegration tests (.github/workflows/integration-tests.yml) at a team-owned SSO bearer token, authenticated via a dedicated least-privilege GitHub-OIDC role, replacing the previous token-refresher role + lambda that has been removed.Changes
arn:aws:iam::550160095699:role/LanguageServersGitHubActionsReadRole(us-east-1), session namelsp-integ-ci.Refresh Tokenstep (aws lambda invoke ... TokenRefresherLambda): the token secret is refreshed out-of-band every ~5 min, and the new role intentionally has nolambda:InvokeFunction.secretsmanager:GetSecretValue+jqextraction of the access token intoTEST_SSO_TOKEN, and masks it with::add-mask::(public repo).AWS_SDK_UA_APP_ID=lsp-integ-ciso the token provider's dashboards can attribute/exclude CI traffic.Security
sub(branch refs, not:*) andaud=sts.amazonaws.com.secretsmanager:GetSecretValueon one secret +kms:Decrypton its key. No write, no lambda.Testing
integration-tests.ymlruns post-merge viaworkflow_run(not a PR gate). Once unblocked, we'll trigger a post-merge run and confirm the OIDC assume succeeds, the token is masked, andq-agentic-chat-serverpasses across the OS matrix. Forworkflow_runevents the OIDCsubref will be verified against the trust policy on that first run.