adam/seahaven-slack-bot
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add GitHub Actions deploy workflow #28

Merged
amoussa1229 merged 3 commits from feature/add-deploy-workflow into main 2026-05-08 21:08:12 +00:00
Conversation 4 Commits 3 Files changed 1 +18
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.github/workflows/deploy.yaml vendored Normal file
View file

@ -0,0 +1,18 @@
name: Deploy
on:
push:
branches: [main]
permissions:
id-token: write
contents: read
concurrency:
group: deploy
cancel-in-progress: false
jobs:
deploy:
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
secrets:
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
cursor[bot] commented 2026-05-08 20:53:10 +00:00 (Migrated from github.com)
Review
Copy link

Missing OIDC permission blocks deploy workflow

High Severity

This OIDC-based deploy workflow is missing the permissions block with id-token: write. GitHub Actions does not grant the id-token permission by default — it must be explicitly declared in the caller workflow. Without it, the reusable cd-cdk.yaml workflow cannot request the JWT needed to assume the AWS deploy role, and every deployment will fail.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0302e6b021. Configure here.

### Missing OIDC permission blocks deploy workflow **High Severity** <!-- DESCRIPTION START --> This OIDC-based deploy workflow is missing the `permissions` block with `id-token: write`. GitHub Actions does not grant the `id-token` permission by default — it must be explicitly declared in the caller workflow. Without it, the reusable `cd-cdk.yaml` workflow cannot request the JWT needed to assume the AWS deploy role, and every deployment will fail. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 22b534b2-fd0e-47e1-b899-949cc5dfc4c6 --> <!-- LOCATIONS START .github/workflows/deploy.yaml#L1-L10 LOCATIONS END --> <div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmUxYjJmOThlLTc3NGMtNDk0OS1iZmVmLTE0Yzc4MzUzNTM0YiIsImVuY3J5cHRpb25LZXkiOiJYcC02czY5V2o0bE1HSUJPS1RZT0JrR0h2RzlqUmFSWUFyeUo4TER0aDdnIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6InNlYWhhdmVuLXNsYWNrLWJvdCJ9LCJpYXQiOjE3NzgyNzM1ODksImV4cCI6MTc4MDg2NTU4OX0.WpkUj4gN9Ip1IkPbijittx9TDn3kFhNZnGrCWL-yQ_d5mpdLvLSxg56T2Aub1kuMaNvXZQ_U9D3neXRIEou-PsEz5kfGH0o5UeZmnDPSf6xxc_LRNb1-D_z-NLVqqhIQTSl-fS4S26XKwOHXFAR7tAzR5QfcoMldSiAKXh5tG5uYfV2aQyAOd3S68zQeaOdnUDKASDDNevl97Bh8Tlmro94czJoTYE2YZOnH0ZfpsIoaZ5eLmeZYuQbxW-dsZcPWu1TAqhldzQYbxe3BBq_wYuOB0Oujlx2MamgK3pfOzUeYgsydZrduzzYIxlLwrfy28S9NnIG7JWWilIrXn1XBLQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmUxYjJmOThlLTc3NGMtNDk0OS1iZmVmLTE0Yzc4MzUzNTM0YiIsImVuY3J5cHRpb25LZXkiOiJYcC02czY5V2o0bE1HSUJPS1RZT0JrR0h2RzlqUmFSWUFyeUo4TER0aDdnIiwiYnJhbmNoIjoiZmVhdHVyZS9hZGQtZGVwbG95LXdvcmtmbG93IiwicmVwb093bmVyIjoiU2VhLUhhdmVuLUluZHVzdHJpZXMiLCJyZXBvTmFtZSI6InNlYWhhdmVuLXNsYWNrLWJvdCIsInByTnVtYmVyIjoyOCwiY29tbWl0U2hhIjoiMDMwMmU2YjAyMWRjZjBhZGY0MjJjYWNkZDMzNzk2ZTZmODU3ZGRiYyIsInByb3ZpZGVyIjoiZ2l0aHViIn0sImlhdCI6MTc3ODI3MzU4OSwiZXhwIjoxNzgwODY1NTg5fQ.AB7KDJDiOVbKvW9Wy_nQ346hGn1Cuwe_C-7Pw_kiWQ2NxUnBDZijsM23odC9RMb4ZG_rCStl0L2lWcC6RCk6K14DddegkFyd5WNnjYXz81Su1bjnVaPSUD2GIf41vJBG14ZdKdIF6Znzzf1gJtq0ELqovZJ-Cdd_kIfo-tGOnxPesJHvKoKwWA1X-F6OSfELSSysY1cHU-2iY65u-K8rEZMh0HR5sdVQEBwSC8NwOB1l8afd54Y8ubTBR3MyANRopi1VYfMP14QF_AC6MRd-x8q9M0N9n6XRHiIjmafJjXTd0NEv5LkxrvzliiqOR2alx9l4EA-MV9UnbZRm1_9Pxg" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0302e6b021dcf0adf422cacdd33796e6f857ddbc. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>