Merge branch 'main' into patch-1

Author: kellertk

.github/workflows/automerge-approved-prs.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           parse-json-secrets: true
           secret-ids: |
-            OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
+            ${{ secrets.OSDS_PACKAGING_ROLE }}
       - name: Enable PR automerge
         run: gh pr merge --auto --squash "$PR_URL"
         env:

.github/workflows/dependabot-autoapprove.yml

@@ -1,6 +1,6 @@
 name: Dependabot auto-approve
-on: 
-  pull_request:
+on:
+  pull_request_target:
   workflow_dispatch:
 
 permissions:
@@ -21,14 +21,14 @@ jobs:
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-region: us-west-2
-          role-to-assume: arn:aws:iam::206735643321:role/ConfigureAwsCredentialsPackageRole
+          role-to-assume: ${{ secrets.CONFIGUREAWSCREDENTIALSPACKAGEROLEARN }}
           role-duration-seconds: 900
       - name: Get bot user token
         uses: aws-actions/aws-secretsmanager-get-secrets@v2
         with:
           parse-json-secrets: true
           secret-ids: |
-            OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
+            ${{ secrets.OSDS_PACKAGING_ROLE }}
       - name: Approve PR if not already approved
         run: |
           gh pr checkout "$PR_URL"

.github/workflows/package-dist.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           parse-json-secrets: true
           secret-ids: |
-            OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
+            ${{ secrets.OSDS_PACKAGING_ROLE }}
       - name: Commit
         run: |
           echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"

.github/workflows/release-please.yml

@@ -32,7 +32,7 @@
           with:
             parse-json-secrets: true
             secret-ids: |
-              OSDS,arn:aws:secretsmanager:us-west-2:206735643321:secret:github-aws-sdk-osds-automation-gebs9n
+              ${{ secrets.OSDS_PACKAGING_ROLE }}
 
         - name: Run release-please
           uses: googleapis/release-please-action@v4