Skip to content

Conversation

@joshbegin
Copy link
Contributor

For security, we require a Github Environment to be specified on a job before allowing it to assume an AWS Role. For example, only a job with environment: qa can assume a role in our QA AWS account.

This requirement prevents the AssetUpload Job from running since there is no "environment" specified. If we use the assetPublishingPerStage property, it tries to change to the appropriate role for each stage (qa, uat, etc...), but, even if we add an environment it will not work since a job can only have one environment.

This PR proposes a useGithubEnvironmentsForAssetUpload boolean property that will allow creation of a separate Job for each stage that can run in parallel and assigns an environment for each job.

@github-actions github-actions bot requested review from Lock128 and hoegertn January 6, 2026 17:48
@hoegertn
Copy link
Contributor

hoegertn commented Jan 6, 2026

Hi, I really like the idea of the feature. There is two thing I would like to ask before reviewing the code:

  1. We need to explain and document the fact, that splitting the asset stage means rebuilding container assets for each stage and they will not be the "same binary"
  2. There are a lot of whitespace changes that make it ahrd to review the code. Any idea where they come from?

@hoegertn
Copy link
Contributor

@joshbegin is this still somethign you would like to tackle?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants