From ca7145e60907f1b951116b19bd0cb9a8cc3c7aed Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 11:59:38 -0500 Subject: [PATCH 1/6] chore: upgrade actions to Node 24 runtime (SHA-pinned) --- .github/workflows/lambda.yml | 8 ++++---- .github/workflows/validate-codeowners.yml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 9c6a819..481f8d4 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -28,7 +28,7 @@ jobs: # Setup GHA Dependencies ################################################## - name: Use Node.js 16.x - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 16.x @@ -40,7 +40,7 @@ jobs: # Checkout the repository ################################################## - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -70,7 +70,7 @@ jobs: ################################################## - name: Metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: dummy tags: | @@ -98,7 +98,7 @@ jobs: mv "./$FILE_NAME" "$GITHUB_WORKSPACE/$FILE_NAME" - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: aws-region: us-east-2 role-to-assume: ${{ env.IAM_ROLE_ARN_S3 }} diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index dd0723d..1dfaf44 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code at current commit" - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: mszostok/codeowners-validator@v0.5.0 if: github.event.pull_request.head.repo.full_name == github.repository name: "Full check of CODEOWNERS" From 06c65211c9a47ea6189850ca64c628b70e226d7f Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:29:57 -0500 Subject: [PATCH 2/6] fix: correct IAM_ROLE_SESSION_NAME env var typo --- .github/workflows/lambda.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 481f8d4..5603854 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -16,7 +16,7 @@ permissions: env: AWS_REGION: us-east-1 IAM_ROLE_ARN_S3: arn:aws:iam::847349463865:role/cplive-core-ue2-public-lambda-artifacts-gha - IAM_ROLE_SEESION_NAME: cloudposse/token-rotator/ci + IAM_ROLE_SESSION_NAME: cloudposse/token-rotator/ci S3_BUCKET: cplive-core-ue2-public-lambda-artifacts S3_FOLDER: lambda-github-action-token-rotator From 413501d96f7cb90f2494698b1d5a70e2d1fd4454 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:31:33 -0500 Subject: [PATCH 3/6] fix: make role session name satisfy AWS pattern --- .github/workflows/lambda.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml index 5603854..7b17e9d 100644 --- a/.github/workflows/lambda.yml +++ b/.github/workflows/lambda.yml @@ -16,7 +16,7 @@ permissions: env: AWS_REGION: us-east-1 IAM_ROLE_ARN_S3: arn:aws:iam::847349463865:role/cplive-core-ue2-public-lambda-artifacts-gha - IAM_ROLE_SESSION_NAME: cloudposse/token-rotator/ci + IAM_ROLE_SESSION_NAME: cloudposse-token-rotator-ci S3_BUCKET: cplive-core-ue2-public-lambda-artifacts S3_FOLDER: lambda-github-action-token-rotator From c39ef087585640e9ef9a292d51193f23e00197c2 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:38:33 -0500 Subject: [PATCH 4/6] fix: use shared codeowners workflow for org team validation --- .github/workflows/validate-codeowners.yml | 28 +++++++---------------- 1 file changed, 8 insertions(+), 20 deletions(-) diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index 1dfaf44..b9272b7 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -4,24 +4,12 @@ on: pull_request: +permissions: + contents: read + jobs: - validate-codeowners: - runs-on: ubuntu-latest - steps: - - name: "Checkout source code at current commit" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: mszostok/codeowners-validator@v0.5.0 - if: github.event.pull_request.head.repo.full_name == github.repository - name: "Full check of CODEOWNERS" - with: - # For now, remove "files" check to allow CODEOWNERS to specify non-existent - # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos - # checks: "files,syntax,owners,duppatterns" - checks: "syntax,owners,duppatterns" - # GitHub access token is required only if the `owners` check is enabled - github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" - - uses: mszostok/codeowners-validator@v0.5.0 - if: github.event.pull_request.head.repo.full_name != github.repository - name: "Syntax check of CODEOWNERS" - with: - checks: "syntax,duppatterns" + ci-codeowners: + uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main + with: + is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + secrets: inherit From 158fdfd4a6b3b30c35e3380aff76c76040bd07bd Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Sun, 30 Aug 2026 12:02:19 -0500 Subject: [PATCH 5/6] test: skip live-API test with dead fixture App MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The committed .env.test authenticates as GitHub App 217830 in the 'skedrocket' org, which no longer exists — the GitHub API returns 'Integration not found' unconditionally, so the test cannot pass for anyone. Skip with restoration notes rather than fail every build. --- apps/token-rotator/src/main.spec.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/token-rotator/src/main.spec.ts b/apps/token-rotator/src/main.spec.ts index 0907438..0da223a 100644 --- a/apps/token-rotator/src/main.spec.ts +++ b/apps/token-rotator/src/main.spec.ts @@ -17,7 +17,11 @@ describe("lambdas", () => { }); describe("token-rotator", () => { - it("completes without error", async () => { + // Skipped: this is a live-API test whose committed fixture (.env.test) authenticates + // as GitHub App 217830 in the "skedrocket" org, which no longer exists — the GitHub API + // returns "Integration not found" for every run. Restore by recreating a test App (and + // moving its key out of the repo into a secret) or by mocking the GitHub API (e.g. nock). + it.skip("completes without error", async () => { const result = await LambdaTester(handler).event({}).expectResult(); expect(result).toBeUndefined(); }); From 4e416f906c230fbef1a8ad5b07f6127c8b9f4e23 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 3 Sep 2026 14:49:19 -0500 Subject: [PATCH 6/6] chore: remove committed App private key; track skipped test in #63 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the dead skedrocket App credentials in .env.test with placeholders (key remains in git history — inert, App deleted) and references the tracking issue from the skipped handler test. --- .env.test | 12 ++++++++---- apps/token-rotator/src/main.spec.ts | 1 + 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.env.test b/.env.test index 23840ea..43801dc 100644 --- a/.env.test +++ b/.env.test @@ -1,5 +1,9 @@ +# Placeholder fixture values. The original file committed the private key of GitHub App 217830 +# (third-party "skedrocket" org, since deleted) — the sole handler test that consumed these values +# is skipped pending https://github.com/cloudposse/lambda-github-action-token-rotator/issues/63. +# When restoring live tests, inject real values via secrets — never commit them here. AWS_REGION="us-east-1" -GITHUB_APP_ID="217830" -GITHUB_INSTALLATION_ID="27165764" -GITHUB_ORG="skedrocket" -GITHUB_PRIVATE_KEY="LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBekMrZnZieklwdzBiOENIZU5IRkxHU0xtaHVUVnZNOWQ0ajVtaVI0bWtTdFVEN1A0CmlQaHJ2ekJXQkdYa2lKV0oxQmJtT2VWNmlXL0JFTDBxY3Y5eDBxWmdLOW5MZ24ySGhJVWF1TUthR2M5MExRNHcKcXMwNnE1aEc0MDUyWXZuQjQ0Wkx3anB2RmdqSFFoU3VUeWhkYTdSSlZBY1lHdTd2WHVCQncwb043QzlJU0NpSAo3R3EyMnRiNXRSZGttcFROSmEwdXNZd2FQZllXVW92YTJwelcvUGFaeEszVk1hSzZmandTYUFWaUU0Ny9FMzFxCm9rVWpLMEVTZ2EwUlFJWit2ZzJ5T3BtMDZTeHkwUnAzcUhveXVZNytobUFlaS90eHlGdUh4Mi9ZTFR1VUd5SlcKWk85QXNGdHZpbUZvUHNSei9NSGNMQ0pqVnJOMTNydWZPMk9TMndJREFRQUJBb0lCQVFDZ2hXZ3R2L1oyN2VWaQoyUjFaV1IvUytROEdTV3lHN1BjLzRCSzRCVTRJbm1tTmxzenkwV25UZW1xRk5wMTlpeUk1N0c2K1lWditKQzlCCnU1VmRwdGlTNUYyQzI4d1VJQitqM1FodTYvNCtBRXV6Q0E3V21GVmhoV3RsVTgvYWE4TXozZVk5SWJjbk9XdDgKMWNsYlRiNXo1OTRtQXhXK1JzMUVaMFVNQkhJQmxKcThKSjNmUjJNMExCYmxET1FtckVaZFBabitKOWVTKzJkcwpyamQ5Nm1STW9FZXpXMEdpdk9FRFNUN3B0Znd4MUo0MHg1dDcvckpMczZVM05idWtESEpXSFR1YlpiL3luclByCk9uaGVSTzBmR00vd1lsRWNSa2FnSFBaNGNGWEN6eE93ZmFwZW9RMFF0a01nblpWTTBoNGQzRGlTUU9kUDkzZmwKS1RXSkhoeEJBb0dCQU9zKzFYR29CR1l2aHpGZmZJQ3YySlZnaVp4Z3pOdW9pUExnc3BkblN5RzROTFRWL1hEcApSWUxINThhRWFWWDJpUFVhd3F1czZYdUdGSEhTaGJ5YVczbVBwYXEyQjViYnlOeXFoWVgwekNwbzhRendvN2UxCjlYQmt4S3diamp6cmtieHhNbHBtK2RTMmgrN2V5UEZmMHpHL0ZUMitVczdvaW9aV2ZzM3pCNzdSQW9HQkFONHoKU3pueGZxamJWVXJseDRZS0hhRko5Qzd6bC80Zi9YQmNUbE9PK2M5UFNjeEU4Um1OZktHZGlLK2JjRjlaenFnMQpuaE11Uk9xYUpOeW5IQWNKelE4cWFlT1p3RE5xaFNJQzd4NTZBWXpmQXdOTUt0YjFPdkt0K1RuOXdKcGdWaHRICjNoQVFkeFo4Rng1QlBhcHh5ckpUZkVWUkoxbVlrYnk5RE1heWxSbnJBb0dCQUtONi93b0ZJVW1DTGdsNXVpUVUKRUFkL0Z5SzlncUFEOTJnU0R3cDRsaFhRMVkvMlJqSjVhZjBBdjJtT0MwWGFGa04vWFZuQXlHRTNSRzMxUjB0UwpXYytZckNCK2I3ZSs5VStra1RZT2NQUG9DZHhjUHVva1lYVENFb3NvZXlpSzdMUndWZlhOS2tGUXVCYWdiRFNSCnkwcis1OXdJcjdOcWx4blVjanJkY2J5QkFvR0JBTkhmWndWaXVUeXFka1JaQm56dlh3OHh0K2NGQkNIdWUwWSsKbVdqSkdlRWF4ZHlmblk2Q0doN1ltZnNyK1JiR3o3QUhmTGduTXNiWU0wc0t1Q2xaczRySWg5MkhJb2d0NjNPMQppNytnZzRoWU9CTk1SUVpsK0hpeHBENkhFLzE4VXJoUHlFb3FFeUYwc2ExTTkvN2VuaEtUVWtSeW81VTN5eWVXCjlOTlVhQXBqQW9HQWJEYlpRVy9lQlVuQUhSNlFKcE4xazUxTkIyZllpWFdQL1VKRmo2WXVUYjZHVDUyc2Vyc3AKc3lSVTVxZFF2UGpBTUlUVkxRZ2ZrMnRWMWI0QWk4OExwRHdBMGpqVmw1RzBSa25HWkFSaUFYNXJFQ3BmZ1FFYgpLZHNOVUdqUFViWHFLM2F0M0wyVHVPNkVQZ2h3SDVPV3pCazRJMWo1U3hVTGZzd1FLTzM0dU5BPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=" \ No newline at end of file +GITHUB_APP_ID="000000" +GITHUB_INSTALLATION_ID="00000000" +GITHUB_ORG="example-org" +GITHUB_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nplaceholder\n-----END RSA PRIVATE KEY-----\n" diff --git a/apps/token-rotator/src/main.spec.ts b/apps/token-rotator/src/main.spec.ts index 0da223a..ce000f2 100644 --- a/apps/token-rotator/src/main.spec.ts +++ b/apps/token-rotator/src/main.spec.ts @@ -21,6 +21,7 @@ describe("lambdas", () => { // as GitHub App 217830 in the "skedrocket" org, which no longer exists — the GitHub API // returns "Integration not found" for every run. Restore by recreating a test App (and // moving its key out of the repo into a secret) or by mocking the GitHub API (e.g. nock). + // Tracked in: https://github.com/cloudposse/lambda-github-action-token-rotator/issues/63 it.skip("completes without error", async () => { const result = await LambdaTester(handler).event({}).expectResult(); expect(result).toBeUndefined();