1
62%
main: 62%

Ran 09 Feb 2026 03:44PM UTC

Files 518

Run time 11s

Badge

Embed ▾

Committed 09 Feb 2026 03:35PM UTC coverage: 61.361% (+0.07%) from 61.292%

Job # 21831437508.1

Build Type

push

github

Committed by

web-flow

Commit Message

Add AWS STS token exchange for OIDC-to-AWS credential conversion (#3659)

* Add AWS STS token exchange for OIDC-to-AWS credential conversion

This implements the Exchanger component that converts OIDC identity tokens
into temporary AWS credentials using STS AssumeRoleWithWebIdentity. The
exchanger uses regional STS endpoints for lower latency and maps STS API
errors to package-level sentinel errors for consistent error handling.

Related: #3567

* Address PR review feedback for AWS STS token exchanger

- Use anonymous credentials for STS client since AssumeRoleWithWebIdentity
  does not require pre-existing AWS credentials
- Remove manual BaseEndpoint override and let the SDK resolve regional
  endpoints natively
- Replace raw STS error wrapping with sentinel errors to prevent leaking
  sensitive information (account IDs, role ARNs, token fragments)
- Convert bare fmt.Errorf validation errors to sentinel errors for
  consistency with the rest of the package
- Add nil check on STS output at the interface boundary

Run Details

42348 of 69014 relevant lines covered (61.36%)

76.88 hits per line

stacklok / toolhive / 21831437508 / 1
62%
main: 62%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21831437508.1

stacklok / toolhive / 21831437508 / 1 62% main: 62%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21831437508.1

stacklok / toolhive / 21831437508 / 1
62%
main: 62%

README BADGES
x