GitHub Actions OIDC Failures Often Stem From Trust Policy Mismatches, Not Permissions

·7 views

When a GitHub Actions job fails to assume an AWS role via OpenID Connect, the root cause is typically a trust policy mismatch rather than insufficient service permissions. AWS evaluates the OIDC identity through sts:AssumeRoleWithWebIdentity before granting any role session, meaning service permissions like s3:* are irrelevant until trust is established. Key trust inputs include the correct OIDC provider, audience value, and the exact GitHub subject claim, which varies based on workflow context such as whether a GitHub Environment is referenced. Notably, repositories created after July 15, 2026 use an immutable subject format tied to owner and repository IDs, while older repositories retain the name-based format unless opted in. Developers should verify the trust policy reflects the repository's actual subject format and avoid broadening service permissions as a workaround for failed trust decisions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Deploy Prowlarr, Radarr, and Sonarr Together Using Docker Compose

A technical guide published on DEV Community explains how to set up the Arr media automation stack—comprising Prowlarr, Radarr, and Sonarr—using a single Docker Compose file. The setup relies on a shared /data directory mounted across all containers, enabling instant hardlink imports instead of slower copy operations that double disk usage. The torrent client, qBittorrent, is routed exclusively through a Gluetun VPN container to isolate torrent traffic from the rest of the network. Container images are sourced from LinuxServer.io and share a unified permissions model via PUID and PGID settings. The guide emphasizes lawful use cases such as personal rips, DRM-free purchases, and public-domain content, noting that downloading copyrighted material without authorization is illegal in most jurisdictions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Documents How AI-Generated Tests Faked 20 Passing Checks in Three Days

A software tooling developer catalogued every self-caused false positive they encountered during the week of 7 September 2026, finding 20 green checkmarks that did not reflect genuine passes. Common failure patterns included checkers returning success when they scanned zero items, grep queries matching irrelevant or misleading content, and timestamps copied from file modification dates rather than actual verification. In one case, a leak checker passed a document because it measured the wrong axis entirely, missing the real category of risk. Pipeline errors caused by shell commands silently failing also reported zero results instead of signalling an unknown state. The developer concluded that a failed or empty measurement should never be treated as a pass, and that any limitation not surfaced in tool documentation is effectively hidden from users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five-Layer Framework Explains How AI Agent Harnesses Work Beyond Simple Chat

A technical breakdown published on DEV Community outlines the concept of an AI 'harness' — the infrastructure surrounding a language model that enables it to read files, execute commands, and loop through decisions autonomously. Unlike standard chat interfaces such as ChatGPT web, agentic tools like Cursor, Kiro, Claude Code, and Windsurf qualify as harnesses because they allow the model to act, observe results, and determine next steps without stopping. The framework identifies five sequential layers that underpin effective agent operation: memory, context, skills, agents, and tools, each serving as the foundation for the next. The article warns that skipping layers — such as implementing RAG before organizing a knowledge vault — trades one problem for another. A key insight is that a weaker model with clean, well-structured context will often outperform a more powerful model operating with poor context.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four-Layer Testing Strategy for MCP Servers: From Unit Tests to CI Pipelines

Developer Nokka has outlined a four-layer automated testing framework for Model Context Protocol (MCP) servers, addressing a common challenge faced by teams building AI tool integrations. The pyramid approach progresses from fast in-memory unit tests — using Python and TypeScript SDKs to test tool logic without launching a real server — up to protocol-level and conformance testing. MCP Inspector's lesser-known command-line mode enables headless server validation with clear exit codes, making it suitable for CI pipeline integration. An official GitHub Action for MCP conformance testing allows teams to verify spec compliance directly in workflow files, a method already adopted by the official Python and Kotlin SDK teams. The fourth and most difficult layer addresses LLM behavioral testing, examining whether real models invoke tools with correct parameters and interpret tool descriptions as intended.

0 comments Read more at DEV Community