From 727ad43e421d4e054e1dc6a86e98c2d678bb64ac Mon Sep 17 00:00:00 2001 From: Laxman Reddy Aileni Date: Mon, 20 Jul 2026 19:16:20 +0000 Subject: [PATCH 1/2] chore(amazonq): use DEXP-owned canary SSO token via OIDC for agentic-chat E2E tests Short-term Flare fix: re-point the q-agentic-chat-server integration tests at the DEXP-owned SSOTokenSecret in the gamma-IAD canary account, replacing the removed Blueshift QnetTransformTokenRefresher. - Configure AWS Credentials now assumes the least-privilege OIDC read role arn:aws:iam::550160095699:role/LanguageServersGitHubActionsReadRole (us-east-1). - Remove the 'Refresh Token' lambda-invoke step; the canary SSORefreshTokenLambda refreshes SSOTokenSecret every ~5 min. - Replace 'Get SSO Token' with a raw GetSecretValue + jq extraction of the canaryGammaIAD accessToken into TEST_SSO_TOKEN, masked via ::add-mask::. - Tag traffic with AWS_SDK_UA_APP_ID=lsp-integ-ci for dashboard/BI segmentation. DO NOT MERGE yet: depends on the OIDC role deploying (canary CR-290695975), AppSec sign-off, and repo secrets TEST_SSO_START_URL + TEST_PROFILE_ARN. --- .github/workflows/integration-tests.yml | 31 +++++++++++++++++-------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 48da971401..d9e3580993 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -52,26 +52,37 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: - role-to-assume: arn:aws:iam::964765661569:role/GitHubActionsTokenRefresherRole - role-session-name: language-servers-github + # DEXP-owned GitHub-OIDC read role in the gamma-IAD canary account (550160095699): + # least-privilege (GetSecretValue on SSOTokenSecret + kms:Decrypt on its key), no lambda. + role-to-assume: arn:aws:iam::550160095699:role/LanguageServersGitHubActionsReadRole + role-session-name: lsp-integ-ci aws-region: us-east-1 - name: Build run: | npm ci npm run compile - - name: Refresh Token - run: aws lambda invoke --function-name TokenRefresherLambda --region us-east-1 --payload '{}' response.json - name: Get SSO Token - uses: aws-actions/aws-secretsmanager-get-secrets@v2 - with: - secret-ids: | - ,SsoTokenSecret - parse-json-secrets: true + # SSOTokenSecret is minted by the canary SSORefreshTokenLambda and self-refreshes + # every ~5 min, so no lambda invoke is needed. Public repo: mask the token in logs. + run: | + SECRET_JSON="$(aws secretsmanager get-secret-value \ + --secret-id SSOTokenSecret \ + --region us-east-1 \ + --query SecretString --output text)" + TEST_SSO_TOKEN="$(printf '%s' "$SECRET_JSON" | jq -r '.createTokenResponseByUser["canaryGammaIAD"].accessToken')" + if [ -z "$TEST_SSO_TOKEN" ] || [ "$TEST_SSO_TOKEN" = "null" ]; then + echo "::error::Failed to extract accessToken for canaryGammaIAD from SSOTokenSecret" + exit 1 + fi + echo "::add-mask::$TEST_SSO_TOKEN" + echo "TEST_SSO_TOKEN=$TEST_SSO_TOKEN" >> "$GITHUB_ENV" - name: Run Integration Tests run: | npm run test-integ -w integration-tests/q-agentic-chat-server env: - TEST_SSO_TOKEN: ${{ env.SSOTOKEN }} + TEST_SSO_TOKEN: ${{ env.TEST_SSO_TOKEN }} TEST_SSO_START_URL: ${{ secrets.TEST_SSO_START_URL }} TEST_PROFILE_ARN: ${{ secrets.TEST_PROFILE_ARN }} TEST_RUNTIME_FILE: ${{ github.workspace }}/downloaded-artifacts/aws-lsp-codewhisperer.js + # Tags LSP CI traffic so RTS ServiceMetrics/dashboards can segment or exclude it (BI). + AWS_SDK_UA_APP_ID: lsp-integ-ci From 6412c1c6fdacae72e13561239fa993ac2a874f86 Mon Sep 17 00:00:00 2001 From: Laxman Reddy Aileni Date: Mon, 20 Jul 2026 22:48:35 +0000 Subject: [PATCH 2/2] chore(amazonq): source integ-test SSO secrets from INTEG_-prefixed names Point TEST_SSO_START_URL / TEST_PROFILE_ARN at new repo secrets INTEG_TEST_SSO_START_URL / INTEG_TEST_PROFILE_ARN instead of the existing TEST_SSO_START_URL / TEST_PROFILE_ARN (the env var names the test reads are unchanged; only the secret source moves). The old secrets still feed the current QnetTransform-based workflow, so overwriting them would risk breaking the currently-passing tests and they are unrecoverable once QnetTransform is torn down. New names keep old and new isolated and preserve a clean rollback: reverting this PR restores the old workflow + old secrets, which still work while QnetTransform is alive. --- .github/workflows/integration-tests.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index d9e3580993..73904cfbc4 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -81,8 +81,8 @@ jobs: npm run test-integ -w integration-tests/q-agentic-chat-server env: TEST_SSO_TOKEN: ${{ env.TEST_SSO_TOKEN }} - TEST_SSO_START_URL: ${{ secrets.TEST_SSO_START_URL }} - TEST_PROFILE_ARN: ${{ secrets.TEST_PROFILE_ARN }} + TEST_SSO_START_URL: ${{ secrets.INTEG_TEST_SSO_START_URL }} + TEST_PROFILE_ARN: ${{ secrets.INTEG_TEST_PROFILE_ARN }} TEST_RUNTIME_FILE: ${{ github.workspace }}/downloaded-artifacts/aws-lsp-codewhisperer.js # Tags LSP CI traffic so RTS ServiceMetrics/dashboards can segment or exclude it (BI). AWS_SDK_UA_APP_ID: lsp-integ-ci