feat(ai-release-notes): add Bedrock provider path with OIDC-derived credentials - #191
Open
simon (susishopware) wants to merge 1 commit into
Open
feat(ai-release-notes): add Bedrock provider path with OIDC-derived credentials#191simon (susishopware) wants to merge 1 commit into
simon (susishopware) wants to merge 1 commit into
Conversation
…redentials Adds provider: bedrock as an alternative to the OpenAI-compatible path. Claude is called on Amazon Bedrock through the aws CLI preinstalled on GitHub-hosted runners, authenticated with the short-lived STS credentials that aws-actions/configure-aws-credentials derives from the workflow's OIDC token — no stored API key. The bedrock path does not send temperature (Claude Sonnet 5 and Opus 5 reject sampling parameters) and defaults to the eu.anthropic.claude-sonnet-5 cross-region inference profile, since bare model ids are rejected for on-demand throughput in eu-central-1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #188. The static-API-key approach for the AI rewrite drew security pushback (shopware/pipe-fiction#1499): a credential that cannot expire on its own is the weaker option when a short-lived one is available. Amazon Bedrock is the consuming team's approved AI provider path, and GitHub's OIDC integration with AWS means the release workflow can authenticate without storing any secret at all.
What changes
New
providerinput (openai|bedrock, defaultopenai— existing consumers are unaffected):provider: bedrockcalls Claude on Amazon Bedrock through theawsCLI preinstalled on GitHub-hosted runners (the CLI does the SigV4 signing, so the action stays dependency-free). Credentials are the ambient short-lived STS credentials fromaws-actions/configure-aws-credentials; the consuming workflow additionally needsid-token: write.gpt-4ofor openai, theeu.anthropic.claude-sonnet-5cross-region inference profile for bedrock. Bare model ids are rejected for on-demand throughput ineu-central-1, and theeu.prefix keeps routing inside EU regions.temperatureon the bedrock path — Claude Sonnet 5 and Opus 5 reject sampling parameters outright.max-output-tokensinput (bedrock only, default 8192) — Claude's adaptive thinking draws from the same output budget.providervalue fails the step, since that is a static misconfiguration rather than an AI outage.The request/response pattern (InvokeModel with a native Anthropic body, body passed as a file to dodge argv limits, text block filtered by type because thinking blocks precede it) mirrors the pattern verified end-to-end against
eu-central-1in shopware/pipe-fiction#1487.🤖 Generated with Claude Code