Repository navigation
ci: use Buildkite OIDC for macOS tarball uploads - #40673
Merged
Merged
Conversation
TarballUploader can now obtain short-lived upload credentials by exchanging the job's Buildkite OIDC token for an IAM role, when MZ_BINARIES_UPLOAD_ROLE_ARN is set. The token is requested right before the upload, since the build that precedes it can outlast the token's lifetime. The three macOS deploy steps opt in. The deploy-mz macOS step gains a step key so it has a stable identity like the other deploy steps. Linux uploads are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
def-
approved these changes
Nov 13, 2026
Alphadelta14
approved these changes
Nov 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The macOS deploy steps currently upload to the binaries bucket with credentials from the agent's environment. This moves them to short-lived credentials obtained per job through Buildkite's OIDC integration. That way the macOS agents need no AWS configuration of their own, which simplifies setting them up.
Changes
TarballUploaderbuilds its S3 client in one place. WhenMZ_BINARIES_UPLOAD_ROLE_ARNis set, it runsbuildkite-agent oidc request-token --audience sts.amazonaws.comand exchanges the token throughAssumeRoleWithWebIdentity. Otherwise it uses the default credential chain as before. The token is requested lazily, right before the first upload, because the cargo build that precedes it can take longer than the token's lifetime.deploy-mz,deploy-mz-deployanddeploy-mz-debugmacOS steps setMZ_BINARIES_UPLOAD_ROLE_ARN.deploy-mzmacOS step gets a step key,deploy_mz-macos-aarch64, matching the other deploy pipelines.Linux deploys are unchanged.
Rollout
The IAM role must exist before this merges. Until then the macOS uploads would fail at
AssumeRoleWithWebIdentity. After merging, the nextdeploy-mz-deployordeploy-mz-debugbuild onmainexercises it.🤖 Generated with Claude Code