ReviewOS
Reload

also looking at this

stacks/bunpress

fix(ci): deploy with encrypted production env

#82
Merged chrisbbreuer wants to merge agent/oidc-encrypted-production-env into main
6 files +89 -16

What changed

  • replace long-lived GitHub AWS secrets with a branch-scoped AWS OIDC role
  • load the encrypted, committed .env.production using @stacksjs/env
  • retrieve the gitignored .env.keys content from AWS SSM Parameter Store
  • deploy to the configured S3 bucket and invalidate the configured CloudFront distribution

Why

The previous main-branch deployment failed with InvalidClientTokenId because its GitHub AWS credentials were stale. OIDC supplies short-lived AWS credentials on each push and removes the credential-rotation failure mode.

Validation

  • bun run lint
  • bun run build
  • bun run typecheck
  • bun test (540 passing)
  • local encrypted production-env load
  • IAM policy simulation for SSM, S3, and CloudFront permissions

6 changed files on the files tab, with 0 review threads.