try again

huggingface · Oct 17, 2023 · b0aaa83 · b0aaa83
1 parent 763a56e
commit b0aaa83
Showing 1 changed file with 9 additions and 6 deletions.
diff --git a/.github/workflows/test_onnxruntime_gpu.yml b/.github/workflows/test_onnxruntime_gpu.yml
@@ -15,24 +15,25 @@ jobs:
   start-runner:
     if: ${{ (github.event_name == 'workflow_dispatch') || (github.event_name == 'schedule') || contains( github.event.pull_request.labels.*.name, 'gpu-test') }}
     name: Start self-hosted EC2 runner
+    permissions:
+      id-token: write
+      contents: read
     runs-on: ubuntu-latest
     env:
       AWS_REGION: us-east-1
       EC2_AMI_ID: ami-0dc1c26161f869ed1
       EC2_INSTANCE_TYPE: g4dn.xlarge
       EC2_SUBNET_ID: subnet-859322b4,subnet-b7533b96,subnet-47cfad21,subnet-a396b2ad,subnet-06576a4b,subnet-df0f6180
       EC2_SECURITY_GROUP: sg-0bb210cd3ec725a13
-      EC2_IAM_ROLE: optimum-ec2-github-actions-role
+      EC2_IAM_ROLE: optimum-oidc-github-actions-role
     outputs:
       label: ${{ steps.start-ec2-runner.outputs.label }}
       ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
     steps:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
-        secrets: inherit
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.OPTIMUM_OIDC_IAM_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
       - name: Start EC2 runner
         id: start-ec2-runner
@@ -71,6 +72,9 @@ jobs:
     needs:
       - start-runner # required to get output from the start-runner job
       - do-the-job # required to wait when the main job is done
+    permissions:
+      id-token: write
+      contents: read
     runs-on: ubuntu-latest
     env:
       AWS_REGION: us-east-1
@@ -79,8 +83,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.OPTIMUM_OIDC_IAM_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
       - name: Stop EC2 runner
         uses: philschmid/philschmid-ec2-github-runner@main