chore(ci): replace AWS static credentials with GitHub OIDC

[mohanarpit]

Summary

• Replace long-lived AWS AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY static credentials in three GitHub Actions workflows with short-lived OIDC tokens via aws-actions/configure-aws-credentials@v4
• Add permissions: id-token: write to each affected job to enable GitHub OIDC token issuance
• Affected workflows: helm-release.yml, cleanup-dp.yml, on-demand-build-docker-image-deploy-preview.yml

AWS setup required (one-time, before merging)

• Configure GitHub as an OIDC identity provider in the AWS account (if not already done)
• Create/update IAM roles with trust policy for the GitHub OIDC provider:
  • HELM_AWS_ROLE_ARN (new secret) — role with S3 read/write access to the Helm chart bucket
  • APPSMITH_EKS_AWS_ROLE_ARN (already exists) — role with EKS access for deploy previews
• Once roles are set up, the old secrets (HELM_AWS_ACCESS_KEY_ID, HELM_AWS_SECRET_ACCESS_KEY, APPSMITH_CI_AWS_SECRET_ACCESS_KEY_ID, APPSMITH_CI_AWS_SECRET_ACCESS_KEY) can be deleted

Test plan

• Verify HELM_AWS_ROLE_ARN GitHub secret is created with the correct IAM role ARN
• Verify APPSMITH_EKS_AWS_ROLE_ARN GitHub secret exists and the role has a trust policy for the GitHub OIDC provider
• Trigger helm-release.yml via workflow_dispatch and confirm Helm chart publishes to S3 successfully
• Trigger cleanup-dp.yml via workflow_dispatch and confirm EKS cleanup runs without credential errors
• Open a test PR and run /build-deploy-preview to confirm deploy preview deploys successfully

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Improved error reporting with better context and cause tracking for Git operations and resource access failures.
  • Enhanced permission validation for application snapshot operations with clearer error messages.

• Chores

  • Updated GitHub Actions workflows with improved security configuration for credential handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f0a2e594-6ee0-41ee-9049-7a2afc151f41

📥 Commits

Reviewing files that changed from the base of the PR and between 7f10885 and 02d9251.

📒 Files selected for processing (11)

• .github/workflows/cleanup-dp.yml
• .github/workflows/helm-release.yml
• .github/workflows/on-demand-build-docker-image-deploy-preview.yml
• app/client/src/git/components/ConnectModal/ConnectInitialize/index.tsx
• app/client/src/git/sagas/connectSaga.ts
• app/server/appsmith-interfaces/src/main/java/com/appsmith/external/exceptions/BaseException.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/aspect/ce/GitRouteAspectCE.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/exceptions/AppsmithException.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/git/fs/GitFSServiceCEImpl.java
• app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/ApplicationSnapshotServiceCEImpl.java
• app/server/appsmith-server/src/test/java/com/appsmith/server/services/ApplicationSnapshotServiceTest.java

---

Walkthrough

This PR transitions AWS credentials from static environment variables to OIDC role assumption across three CI/CD workflows, extends Git SSH key handling with updated callback dependencies and payload parameters, strengthens exception chaining to preserve stack traces, refactors repository cleanup sequencing, and adds permission validation to snapshot service operations.

Changes

Cohort / File(s)	Summary
GitHub Actions Security Hardening .github/workflows/cleanup-dp.yml, .github/workflows/helm-release.yml, .github/workflows/on-demand-build-docker-image-deploy-preview.yml	Added explicit job-level permissions (id-token: write, contents: read) and introduced aws-actions/configure-aws-credentials@v4 step to assume IAM roles from secrets, replacing static AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables across all three workflows.
Git SSH Key Handling app/client/src/git/components/ConnectModal/ConnectInitialize/index.tsx, app/client/src/git/sagas/connectSaga.ts	Extended handleNextStep callback dependencies to include sshKeySource and sshKeyId for proper synchronization; added sshKeyId parameter forwarding in connectRequest call.
Exception Chaining & Stack Trace Preservation app/server/appsmith-interfaces/.../BaseException.java, app/server/appsmith-server/.../AppsmithException.java, app/server/appsmith-server/.../GitRouteAspectCE.java	Added overloaded constructors to BaseException and AppsmithException accepting Throwable cause parameter; updated GitRouteAspectCE error handling to preserve original exception cause during wrapping.
Repository & Snapshot Service Refactoring app/server/appsmith-server/.../GitFSServiceCEImpl.java, app/server/appsmith-server/.../ApplicationSnapshotServiceCEImpl.java, app/server/appsmith-server/src/test/.../ApplicationSnapshotServiceTest.java	Fixed error-handling chain sequencing in fetchRemoteRepository; added permission-aware application resolution in getWithoutDataByBranchedApplicationId and deleteSnapshot methods; added test coverage for access denial scenarios.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🔐 Static keys fade to OIDC's embrace,
AWS roles now assume their place,
SSH keys sync with callback care,
Exceptions chain with stack traces fair,
Permissions checked, snapshots secure—
Our code flows cleaner, governance pure! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.88% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore(ci): replace AWS static credentials with GitHub OIDC' accurately and concisely summarizes the main change—replacing static AWS credentials with OIDC in CI workflows.
Description check	✅ Passed	The PR description includes a clear summary, AWS setup requirements, and a test plan. However, it's missing the required 'Fixes #Issue' link and the 'Communication' section from the template.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/replace-aws-static-creds-with-oidc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}