fix workflows to pass secrets to actions

.github/actions/sam-build-and-deploy-containers/action.yml

@@ -38,9 +38,9 @@ runs:
           use-installer: true
     - uses: aws-actions/configure-aws-credentials@v2
       with:
-        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-to-assume: ${{ inputs.aws-role }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: ${{ secrets.AWS_REGION }}
+        aws-region: ${{ inputs.aws-region }}
 
 # Build and deploy x86
     - run: sam build -t ${{ inputs.template-file-path }} --parameter-overrides LambdaArchitecture=${{ inputs.architecture }} --parallel --cached

.github/actions/sam-build-and-deploy-native-arm/action.yml

@@ -39,9 +39,9 @@ runs:
           use-installer: false # use-installer Currently supports Linux x86-64 runners. https://github.com/aws-actions/setup-sam?tab=readme-ov-file#inputs
     - uses: aws-actions/configure-aws-credentials@v2
       with:
-        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-to-assume: ${{ inputs.aws-role }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: ${{ secrets.AWS_REGION }}
+        aws-region: ${{ inputs.aws-region }}
 
 # Build and deploy ARM
     # Because native apps are built in a container, and SAM CLI doesn't know how to mount extra things outside the project directory to the container, move this file manually

.github/actions/sam-build-and-deploy-native/action.yml

@@ -38,9 +38,9 @@ runs:
           use-installer: true
     - uses: aws-actions/configure-aws-credentials@v2
       with:
-        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-to-assume: ${{ inputs.aws-role }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: ${{ secrets.AWS_REGION }}
+        aws-region: ${{ inputs.aws-region }}
 
 # Build and deploy x86
     # Because native apps are built in a container, and SAM CLI doesn't know how to mount extra things outside the project directory to the container, move this file manually

.github/actions/sam-build-and-deploy/action.yml

@@ -35,9 +35,9 @@ runs:
           use-installer: true
     - uses: aws-actions/configure-aws-credentials@v2
       with:
-        role-to-assume: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+        role-to-assume: ${{ inputs.aws-role }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: ${{ secrets.AWS_REGION }}
+        aws-region: ${{ inputs.aws-region }}
 
 # Build and deploy ARM
     - run: sam build -t ${{ inputs.template-file-path }} --parameter-overrides LambdaArchitecture=arm64

.github/workflows/net-31-otel-pipelinE.yaml

@@ -20,6 +20,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '3.1.x'
             template-file-path: ./src/NET31-OTel/template.yaml
             stack-name: net-31-otel

.github/workflows/net-31-pipeline.yaml

@@ -20,6 +20,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '3.1.x'
             template-file-path: ./src/NET31/template.yaml
             stack-name: net-31-base

.github/workflows/net-6-containers-pipeline.yaml

@@ -20,7 +20,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-containers
-          with:           
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '6.x'
             template-file-path: ./src/NET6Containers/template.yaml
             stack-name: net-6-containers-x86-64

.github/workflows/net-6-custumRuntime-pipeline-canary.yaml

@@ -18,7 +18,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
-          with:            
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}          
             dotnet-version: '6.x'
             template-file-path: ./src/NET6CustomRuntime/template.yaml
             project-directory: ./src/NET6CustomRuntime/

.github/workflows/net-6-minimal-api.yaml

@@ -19,7 +19,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:            
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}          
             dotnet-version: '6.x'
             template-file-path: ./src/MinimalAPI/template.yaml
             stack-name: net-6-minimal

.github/workflows/net-6-pipeline-canary.yaml

@@ -18,7 +18,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:           
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}         
             dotnet-version: '6.x'
             template-file-path: ./src/NET6/template.yaml
             stack-name: net-6-base

.github/workflows/net-6-pipeline.yaml

@@ -1,8 +1,8 @@
 name: NET 6
 
 permissions:
-  id-token: write
-  contents: read
+  id-token: write   # This is required for requesting the JWT
+  contents: read    # This is required for actions/checkout
 
 on:
   workflow_dispatch:
@@ -13,9 +13,6 @@ on:
       - src/NET6/**
 env:  
   AWS_REGION : eu-west-1
-permissions:
-  id-token: write   # This is required for requesting the JWT
-  contents: read    # This is required for actions/checkout
 
 jobs:
   build-deploy:
@@ -25,7 +22,9 @@ jobs:
           uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:            
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}           
             dotnet-version: '6.x'
             template-file-path: ./src/NET6/template.yaml
             stack-name: net-6-base

.github/workflows/net-6-top-level-statements.yaml

@@ -15,7 +15,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:            
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}         
             dotnet-version: '6.x'
             template-file-path: ./src/NET6TopLevelStatements/template.yaml
             stack-name: net-6-top-level

.github/workflows/net-6-with-power-tools.yaml

@@ -19,7 +19,9 @@ jobs:
         - uses: actions/checkout@v2  
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
-          with:            
+          with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}    
             dotnet-version: '6.x'
             template-file-path: ./src/NET6WithPowerTools/template.yaml
             stack-name: net-6-power-tools

.github/workflows/net-7-native-aot-canary.yaml

@@ -19,6 +19,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7Native/template.yaml
             project-directory: ./src/NET7Native/

.github/workflows/net-7-native-aot-pipeline.yaml

@@ -20,6 +20,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7Native/template.yaml
             project-directory: ./src/NET7Native/

.github/workflows/net-7-pipeline-canary.yaml

@@ -19,6 +19,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7/template.yaml
             project-directory: ./src/NET7/

.github/workflows/net-7-pipeline.yaml

@@ -20,6 +20,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '7.x'
             template-file-path: ./src/NET7/template.yaml
             project-directory: ./src/NET7/

.github/workflows/net-8-native-aot-pipeline-canary.yaml

@@ -19,6 +19,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '8.x'
             template-file-path: ./src/NET8Native/template.yaml
             project-directory: ./src/NET8Native/
@@ -34,8 +36,7 @@ jobs:
         - name: Build and Deploy ARM
           uses: ./.github/actions/sam-build-and-deploy-native-arm
           with:
-            aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-            aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
             aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '8.x'
             template-file-path: ./src/NET8Native/template.yaml

.github/workflows/net-8-native-aot-pipeline.yaml

@@ -22,6 +22,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy-native
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '8.x'
             template-file-path: ./src/NET8Native/template.yaml
             project-directory: ./src/NET8Native/

.github/workflows/net-8-pipeline-canary.yaml

@@ -19,6 +19,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '8.x'
             template-file-path: ./src/NET8/template.yaml
             project-directory: ./src/NET8/

.github/workflows/net-8-pipeline.yaml

@@ -21,6 +21,8 @@ jobs:
         - name: Build and Deploy
           uses: ./.github/actions/sam-build-and-deploy
           with:
+            aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+            aws-region: ${{ secrets.AWS_REGION }}
             dotnet-version: '8.x'
             template-file-path: ./src/NET8/template.yaml
             stack-name: net-8-base

.github/workflows/net-9-pipeline-canary.yaml

@@ -19,6 +19,8 @@ jobs:
       - name: Build and Deploy
         uses: ./.github/actions/sam-build-and-deploy-native
         with:
+          aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}
+          aws-region: ${{ secrets.AWS_REGION }}
           dotnet-version: '9.x'
           template-file-path: ./src/NET9CustomRuntime/template.yaml
           project-directory: ./src/NET9CustomRuntime/
@@ -31,9 +33,8 @@ jobs:
       - uses: actions/checkout@v2
       - name: Build and Deploy
         uses: ./.github/actions/sam-build-and-deploy-native-arm
-        with:
-          aws-access-key: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        with:      
+          aws-role: ${{ secrets.AWS_SAM_DEPLOYMENT_ROLE }}    
           aws-region: ${{ secrets.AWS_REGION }}
           dotnet-version: '9.x'
           template-file-path: ./src/NET9CustomRuntime/template.yaml