ci: upgrade cagent-action to v1.4.3 with OIDC-based credential fetching#13774
Closed
zampani-docker wants to merge 1 commit intomainfrom
Closed
ci: upgrade cagent-action to v1.4.3 with OIDC-based credential fetching#13774zampani-docker wants to merge 1 commit intomainfrom
zampani-docker wants to merge 1 commit intomainfrom
Conversation
Bump from v1.3.1 to v1.4.3. Remove all explicitly passed secrets — ANTHROPIC_API_KEY, CAGENT_ORG_MEMBERSHIP_TOKEN, CAGENT_REVIEWER_APP_ID, and CAGENT_REVIEWER_APP_PRIVATE_KEY are all now fetched automatically inside the called workflow via OIDC from AWS Secrets Manager. Add id-token: write and actions: read permissions required by the new setup-credentials action. Signed-off-by: Michael Zampani <michael.zampani@docker.com> Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
zampani-docker
force-pushed
the
zampani/upgrade-cagent-action-oidc
branch
from
72d4cef to
d3c800c
Compare
![docker-agent[bot]](https://avatars.githubusercontent.com/in/2787757?s=60&v=4){kind=small}
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
This CI workflow upgrade is a clean, well-structured change. The key modifications are:
- Action version bump: , pinned to commit hash — good supply-chain hygiene.
- Secrets removal: The four explicit secrets (, , , ) are correctly removed; v1.4.3 fetches credentials automatically via OIDC from AWS Secrets Manager.
- New permissions:
id-token: write(OIDC token exchange) andactions: read(cross-workflow artifact download) are both documented with inline comments and scoped to the job level only — consistent with least-privilege. - Comment cleanup: Removal of the verbose top-level permissions comment is a minor improvement.
No bugs or correctness issues found in the changed code.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the PR auto-review workflow to use a newer pinned revision of docker/cagent-action that supports fetching required credentials via OIDC (instead of passing GitHub Secrets into the reusable workflow), while scoping the additional token permissions to the review job.
Changes:
- Bump
docker/cagent-actionreusable workflow from v1.3.1 to v1.4.3 (pinned SHA). - Remove the explicit
secrets:mappings previously passed into the reusable workflow. - Add job-scoped
permissionsforid-token: write(OIDC) andactions: read(artifact access acrossworkflow_runboundaries).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
Hey @zampani-docker |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker/cagent-actionfromv1.3.1→v1.4.3(pinned toec4865576952df6285652f2cf8ffb4ad45ff5f80)ANTHROPIC_API_KEY,CAGENT_ORG_MEMBERSHIP_TOKEN,CAGENT_REVIEWER_APP_ID, andCAGENT_REVIEWER_APP_PRIVATE_KEYare all now fetched automatically inside the called workflow via OIDC from AWS Secrets Managerid-token: write(required for the OIDC token exchange insetup-credentials) andactions: read(required for cross-workflow_runartifact download in the feedback loop), both scoped to thereviewjob onlysecrets:block entirelyTest plan