@alanbraulio-plankchecks…mcpg-243-oidc-deploy → main1 files · +4 −3updated 14h agoid-token: write permission to the workflowaws-access-key-id/aws-secret-access-key with role-to-assume pointing to the new OIDC roletoken.actions.githubusercontent.comgithub-actions-deploy-proxy with trust policy scoped to ComposioHQ/composio-enterprise on refs/heads/maindeploy-proxy-ecs policy (ECR push, ECS task def, ECS service update, IAM PassRole)workflow_dispatchAWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from GitHub Secretsgithub-actions-deployOld IAM user and static keys remain active until cleanup step. If OIDC fails, revert this PR and the deploy will use the existing keys.
Closes MCPG-243
@codex review
Codex Review: Didn't find any major issues. Delightful!
Reviewed commit: b21a06511b
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Priority: P1 (week 1) · Effort: S · Type: ops · (Missed by the original sweep)
Why: The latest commit swapped OIDC federation for long-lived static AWS access keys in CI — the opposite of post-incident hygiene (the breach was credential exfiltration).
Evidence: commit 31f1ea9 ci: switch proxy deploy from OIDC to access key auth; .github/workflows/deploy-proxy-aws.yml.
Fix: Restore aws-actions/configure-aws-credentials with role-to-assume + OIDC; delete the static keys from GitHub secrets and IAM.
Acceptance: Deploy uses short-lived assumed-role creds; no static AWS keys in CI or IAM.
The latest updates on your projects. Learn more about Vercel for GitHub.
| Project | Deployment | Actions | Updated (UTC) |
|---|---|---|---|
| composio-enterprise-internal |  Error | Jun 12, 2026 6:26pm |
@alanbraulio-plank must be a member of the Composio team on Vercel to deploy. - Click here to add @alanbraulio-plank to the team. - If you initiated this build, request access.
Learn more about collaboration on Vercel and other options here.