From 0a5db94d93b01e50e0a6a4c8420d9eb5a262f8b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fahreddin=20=C3=96zcan?= <ozcanfahrettinn@gmail.com>
Date: Thu, 13 Aug 2026 13:21:44 +0300
Subject: [PATCH 1/2] ci: use OIDC for ECR deployment

---
 .github/workflows/ecr-deploy.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ecr-deploy.yml b/.github/workflows/ecr-deploy.yml
index 6e849389e..f9a198a08 100644
--- a/.github/workflows/ecr-deploy.yml
+++ b/.github/workflows/ecr-deploy.yml
@@ -8,6 +8,10 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -19,9 +23,10 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
+          role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+          allowed-account-ids: "640168447591"
+          role-session-name: context7-ecr-${{ github.run_id }}
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -42,7 +47,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ${{ secrets.ECR_REGISTRY }}/${{ secrets.ECR_REPOSITORY }}:${{ inputs.version }}
+            ${{ steps.login-ecr.outputs.registry }}/context7mcp:${{ inputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

From a2e010c0a614f80ca565962846bf8eec79a7ac2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fahreddin=20=C3=96zcan?= <ozcanfahrettinn@gmail.com>
Date: Thu, 13 Aug 2026 13:34:33 +0300
Subject: [PATCH 2/2] ci: keep AWS identifiers in secrets

---
 .github/workflows/ecr-deploy.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ecr-deploy.yml b/.github/workflows/ecr-deploy.yml
index f9a198a08..9bd109709 100644
--- a/.github/workflows/ecr-deploy.yml
+++ b/.github/workflows/ecr-deploy.yml
@@ -23,9 +23,10 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
-          aws-region: ${{ vars.AWS_REGION }}
-          allowed-account-ids: "640168447591"
+          role-to-assume: ${{ secrets.AWS_ECR_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+          allowed-account-ids: ${{ secrets.AWS_ACCOUNT_ID }}
+          mask-aws-account-id: true
           role-session-name: context7-ecr-${{ github.run_id }}
 
       - name: Login to Amazon ECR
@@ -47,7 +48,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ${{ steps.login-ecr.outputs.registry }}/context7mcp:${{ inputs.version }}
+            ${{ secrets.ECR_REGISTRY }}/${{ secrets.ECR_REPOSITORY }}:${{ inputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max