DEVOPS-12289: Move OIDC config to the open-turo

[kennedy-whytech]

Description

Move OIDC config to open-turo

Part of the OIDC configuration has been moved to open-turo. This change enable developers to use the OIDC configuration in multiple actions without duplicating the configuration.

Centralizing setup logic in the reusable workflow is convenient and ensures consistency. It’s a trade-off between encapsulation (all logic in the reusable workflow) and optimization (doing setup only once from the consumer workflow).

The workflow has been tested in https://github.com/turo/platform-scratch-infrastructure/pull/176

Fixes #DEVOPS-12289

Changes

• feat(gha): move OIDC config to the reusable workflow

🚀 PR created with fotingo

[github-actions]

Release notes preview

Below is a preview of the release notes if your PR gets merged.

---

2.0.0 (2024-12-13)

⚠ BREAKING CHANGES

• gha: remove aws cli installation and credential configuration from consumer workflow

Features

• gha: move OIDC config to the reusable workflow (edefcec)

Continuous Integration

• use renovate, update CI and precommit and automate docs (83c63a1)

---

Breaking changes file docs/breaking-changes/v2.md

Breaking changes in v2

Move OIDC config to the reusable workflow

Description of changes

The OIDC configuration has been moved to the reusable workflow. This change enable developers to use the OIDC configuration in multiple actions without duplicating the configuration.

Upgrade instructions

Update from:

permissions:
  id-token: write # This is required for requesting the JWT for OIDC
  contents: read

  ...
  - name: Install aws cli
    run: |
        pip install awscli==1.33.21
        aws --version

  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
        role-skip-session-tagging: true
        role-to-assume: ROLE-TO-ASSUME-WITH-OIDC
        aws-region: us-east-1

  - name: Upload to S3 bucket
    uses: open-turo/actions-s3-artifact/upload@v1
    id: aws-s3-upload
    with:
      compress: false
      path: PATH-TO-UPLOAD
      s3uri: S3-URI
      aws-region: us-east-1

to the following:

permissions:
  id-token: write # This is required for requesting the JWT for OIDC
  contents: read

  ...

  - name: Upload to S3 bucket
    uses: open-turo/actions-s3-artifact/upload@v2
    id: aws-s3-upload
    with:
      compress: false
      path: PATH-TO-UPLOAD
      s3uri: S3-URI
      aws-region: us-east-1
      role-to-assume-with-oidc: ${{ ROLE-TO-ASSUME-WITH-OIDC }} # the role can be defined in the GHA Repository secrets or inline

---

[tagoro9]

Should this just be role-to-assume? And specify in the docs that it's expected that the agents where this run have the permissions to assume this role (using the OIDC or other means)?

[tagoro9]

Is this required? Or should we let the consumer decide how to install / if they need to install the AWS CLI?

Pinning the version here doesn't seem ok (what if a consumer wants to use v2 of the CLI?)