From 08cd225b782ddd367504c296669911731e396a27 Mon Sep 17 00:00:00 2001
From: XtremeOwnage <5262735+XtremeOwnageDotCom@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:01:59 -0500
Subject: [PATCH] fix(action): forward AWS credentials into the build container

The action runs netdocs inside a container and passed through only HOME, so any plugin reaching AWS during the build had no credentials to resolve, however the surrounding workflow had configured them. An imported-docs S3 source failed with 'Failed to resolve AWS credentials' even directly after aws-actions/configure-aws-credentials succeeded.

Standard AWS_* variables present on the runner are now forwarded, and a web-identity token file is mounted and re-pointed at its in-container path.
---
 action.yml                         | 17 +++++++++++++++++
 docs-site/docs/setup/publishing.md |  4 ++++
 2 files changed, 21 insertions(+)

diff --git a/action.yml b/action.yml
index 94600c3..a46a863 100644
--- a/action.yml
+++ b/action.yml
@@ -114,6 +114,22 @@ runs:
 
         echo "Running: netdocs ${cmd[*]} (in ${run_dir})"
 
+        # Forward AWS credentials so plugins that reach S3 during the build (imported-docs
+        # pull sources, for one) can authenticate. A web-identity token lives in a file on
+        # the runner, so that file has to be mounted as well as named.
+        aws_args=()
+        for var in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN \
+                   AWS_REGION AWS_DEFAULT_REGION AWS_ROLE_ARN AWS_ROLE_SESSION_NAME; do
+          if [ -n "${!var:-}" ]; then
+            aws_args+=(-e "${var}")
+          fi
+        done
+        if [ -n "${AWS_WEB_IDENTITY_TOKEN_FILE:-}" ] && [ -f "${AWS_WEB_IDENTITY_TOKEN_FILE}" ]; then
+          token_path="$(cd "$(dirname "${AWS_WEB_IDENTITY_TOKEN_FILE}")" && pwd)/$(basename "${AWS_WEB_IDENTITY_TOKEN_FILE}")"
+          aws_args+=(-v "${token_path}:/tmp/aws-web-identity-token:ro")
+          aws_args+=(-e "AWS_WEB_IDENTITY_TOKEN_FILE=/tmp/aws-web-identity-token")
+        fi
+
         # Mount the checked-out workspace and run as the runner user so generated
         # files (e.g. ./site) are owned by the runner and readable by later steps.
         docker run --rm \
@@ -121,6 +137,7 @@ runs:
           -w "${run_dir}" \
           -u "$(id -u):$(id -g)" \
           -e HOME=/tmp \
+          "${aws_args[@]}" \
           "${ref}" "${cmd[@]}"
 
         echo "image=${ref}" >> "${GITHUB_OUTPUT}"
diff --git a/docs-site/docs/setup/publishing.md b/docs-site/docs/setup/publishing.md
index 2f34d86..4837771 100644
--- a/docs-site/docs/setup/publishing.md
+++ b/docs-site/docs/setup/publishing.md
@@ -142,6 +142,10 @@ Inputs:
 The action runs on Linux, Windows, and macOS runners (x64, plus Apple Silicon). Pin to a
 major tag like `@v1` for stability, or a full version tag for reproducible builds.
 
+Any AWS credentials already configured on the runner are forwarded into the build, so a
+preceding `aws-actions/configure-aws-credentials` step is enough to authenticate plugins
+that read from S3 — [imported docs](../plugins/imported-docs.md) pull sources, for example.
+
 ## Built-in deploy targets
 
 Instead of wiring up a workflow, `netdocs` can publish the build itself. Add a `deploy`