Repository navigation
suzuki-shunsuke
Shunsuke Suzuki
Issues | Pull Requests | v0.6.2...v0.6.3 | Base revision
Features
#795 Drop the AWS SDK from the bundle
The KMS support added in v0.6.2 brought @aws-sdk/client-kms with it, and @suzuki-shunsuke/actions-aws-oidc brought @aws-sdk/credential-provider-web-identity. Together they cost 1.16 MiB in order to make two API calls, and an action pays that on every job because GitHub Actions downloads it each time.
Both libraries now call those APIs over HTTPS directly, so the SDK is gone entirely:
- github-app-jwt-aws-kms 0.2.0 signs with SigV4 via
aws4fetch - actions-aws-oidc 0.2.0 posts to
AssumeRoleWithWebIdentity, which carries no signature because the OIDC token is what authenticates it
Each figure below is a real build, with the KMS path stripped from the source to get the baseline:
| dist total | cost of KMS support | |
|---|---|---|
app_private_key only |
5,482,021 | — |
| v0.6.2 | 6,696,202 | +1,214,181 (1.16 MiB, +22.1%) |
| v0.6.3 | 5,521,606 | +39,585 (39 KB, +0.7%) |
The bundle drops 1.12 MiB, 17.5% of it, and the KMS support costs 96.7% less than it did in v0.6.2.
Compatibility
The inputs are unchanged and so is the behaviour, with one exception.
Leaving aws_role_to_assume unset now reads the credentials from AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN, rather than going through the full AWS credential chain. That is what aws-actions/configure-aws-credentials exports, so the documented way of using this action is unaffected.
What is no longer picked up implicitly is a ~/.aws/credentials profile, which configure-aws-credentials writes when aws-profile is set, IMDS on a self-hosted EC2 runner, and the credentials of an ECS or EKS task. On a hosted runner none of these applies. Running aws-actions/configure-aws-credentials first covers all of them, since it exports those environment variables.
action.yaml and the README describe this now, having said "the standard AWS credential chain" and "the AWS SDK's own resolution" before. The README example also pinned v0.6.1, which predates the KMS support it demonstrates.
aws_region is unchanged in practice: a key ARN still carries the region, and the fallback is now AWS_REGION or AWS_DEFAULT_REGION rather than the SDK's own resolution, which also read ~/.aws/config. The action fails when none of them says which region the key is in.