Release: publish-s3 fails with AWS OIDC 'Not authorized to perform sts:AssumeRoleWithWebIdentity', skipping choco/brew/winget

[padak]

The publish-s3 job failed on the v0.80.1 release, which cascaded: chocolatey, homebrew, winget and test-install all depend on it and were skipped. The apt/dnf repository therefore does not have 0.80.1, and neither do the package managers.

Run 31509118096

Run aws-actions/configure-aws-credentials@v6
  Retry AssumeRole: attempt 1 of 12 failed: Could not assume role with OIDC:
  Not authorized to perform sts:AssumeRoleWithWebIdentity
  ...
  Retry AssumeRole: reached max retries (12); giving up.
  ##[error]Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

This is AWS-side, not a workflow regression

• publish-s3 succeeded on v0.80.0 and on every release before it; v0.80.1 is the first failure.
• .github/workflows/release-kbagent.yml is byte-identical between the v0.80.0 and v0.80.1 tags — git diff v0.80.0 v0.80.1 -- .github/workflows/release-kbagent.yml is empty. The only workflow touched between the two releases is ci.yml, unrelated to this job.
• The job declares id-token: write and passes secrets.AWS_ROLE_ARN, unchanged.

So the token being presented is the same shape as the one that worked last week. Something changed on the AWS side: the role's trust policy, its conditions (sub / aud matching for this repo or ref pattern), or the role/secret itself.

Needs someone with IAM access — I have none, and there is nothing in this repository to change.

What did ship for 0.80.1

Unaffected, because they run before this job:

• ✅ GitHub Release with all 15 assets, including keboola-cli2_0.80.1_windows_amd64.zip
• ✅ PyPI (keboola-cli 0.80.1)

Which means the uv / pip path — the one install.sh uses and the one the self-update reads — is fine. Missing are the apt/dnf repo, Homebrew and Chocolatey.

Worth deciding while someone is in there

Chocolatey has been stale for a long time independently of this: keboola-cli2 sits at 0.66.1 against a current 0.80.1, so that channel has been silently broken for many releases. And there is no WinGet package at all — nothing has ever been submitted to microsoft/winget-pkgs — while the frozen binary points users at winget upgrade Keboola.KeboolaCLI2 (see also #485). Either wire these up properly or stop advertising them in kbagent update output.

[padak]

This is a regression of #453, not a new problem — which should make it much faster to fix.

@Matovidlo you fixed this exact failure on the AWS side back in July. It was confirmed working on v0.71.0 and v0.72.0, and kept working through v0.80.0. It broke again on v0.80.1 and failed identically on v0.80.2.

Same error, same job, same step:

Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Whatever the IAM trust-policy change was last time is likely what needs re-applying or re-checking — possibly an expiry, a rotated role, or a condition that no longer matches this repo's OIDC sub. Nothing in the workflow changed: release-kbagent.yml is byte-identical between the v0.80.0 and v0.80.2 tags.

Worth considering a guard so this cannot fail silently again: publish-s3 failing takes chocolatey, homebrew, winget and test-install down with it, and the overall run is red for several reasons at once, so "the release pipeline is red again" stopped being informative a while ago. Two releases shipped today with the apt/dnf repo silently untouched.

Related distribution gaps already tracked separately, not part of this: Chocolatey 403 with 0.66.1 still published (#502) and the winget package never bootstrapped (#484).

[Matovidlo]

@padak should be fixed now, I have rerun the tag release, verify and close the issue

[padak]

Verified — the OIDC fix holds. Closing.

Run 31548010089 (tag v0.82.0, attempt 4): publish-s3 ✅, homebrew ✅, chocolatey ✅, test-install ✅.

Checked against the live endpoints rather than the job colours:

• apt Packages index lists 0.82.0
• rpm primary.xml.gz lists 0.82.0
• v0.82.0/keboola-cli2_0.82.0_windows_amd64.zip → HTTP 200
• Homebrew tap formula is at version "0.82.0"
• test-install actually installed 0.82.0 via apt, dnf and brew

Thanks @Matovidlo.

Still red, but not this issue

winget fails on repos/microsoft/winget-pkgs/.../KeboolaCLI2 was not found — wingetcreate update cannot bump a package that was never submitted. That is #484.

chocolatey is greener than it is true: the job succeeds and logs keboola-cli2.0.82.0.nupkg was pushed successfully, but the public feed still serves only 0.66.1 (published 2026-07-15). The push sits in moderation. That is #502.

Two side findings, not filed

1. v0.80.1–v0.80.4 never reached apt/dnf/brew and their versioned S3 assets 404. No user impact (0.82.0 superseded them), but any link to a v0.80.x binary is dead.
2. The v0.81.0 tag was cut on a commit whose pyproject.toml already said 0.82.0; gate caught it and the tag is gone. 0.81.0 exists on neither GitHub nor PyPI — yet changelog.py still carries a "0.81.0" key, so kbagent changelog advertises a release nobody ever received.