ci: switch test-warehouse AWS auth to OIDC role (CORE-687)

.github/workflows/cleanup-stale-schemas.yml

@@ -20,6 +20,9 @@ env:
 jobs:
   cleanup:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -30,6 +33,13 @@ jobs:
           - databricks_catalog
           - athena
     steps:
+      - name: Configure AWS credentials
+        if: matrix.warehouse-type == 'athena'
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
+          aws-region: eu-west-1
+
       - name: Checkout dbt package
         uses: actions/checkout@v6
         with:

.github/workflows/test-all-warehouses.yml

@@ -78,6 +78,12 @@ jobs:
 
   test:
     needs: [check-fork-status, approve-fork]
+    permissions:
+      contents: read
+      # Required so the called test-warehouse.yml can mint an OIDC token to
+      # assume the AWS role; per GitHub, id-token: write must be granted by
+      # the calling workflow.
+      id-token: write
     if: |
       ! cancelled() &&
       needs.check-fork-status.result == 'success' &&

.github/workflows/test-release.yml

@@ -43,6 +43,12 @@ jobs:
           echo "dbt bumped: ${{ steps.bump-tag.outputs.dbt-bumped }}"
 
   validate-upgrade-cli:
+    permissions:
+      contents: read
+      # Required so the called test-warehouse.yml can mint an OIDC token to
+      # assume the AWS role; per GitHub, id-token: write must be granted by
+      # the calling workflow.
+      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/test-warehouse.yml

@@ -70,6 +70,9 @@ jobs:
     defaults:
       run:
         working-directory: elementary
+    permissions:
+      contents: read
+      id-token: write
     concurrency:
       # Serialises runs for the same warehouse × dbt-version × branch.
       # The schema name is derived from a hash of this group (see "Write dbt profiles").
@@ -82,6 +85,12 @@ jobs:
           path: elementary
           ref: ${{ inputs.elementary-ref }}
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
+          aws-region: eu-west-1
+
       - name: Checkout dbt package
         uses: actions/checkout@v6
         with:
@@ -382,8 +391,6 @@ jobs:
       - name: Run send report
         env:
           SLACK_TOKEN: ${{ secrets.CI_SLACK_TOKEN }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AZURE_CONNECTION_STRING: ${{ secrets.AZURE_CONNECTION_STRING }}
         run: >
           edr monitor send-report
@@ -394,8 +401,6 @@ jobs:
           --slack-token "$SLACK_TOKEN"
           --slack-channel-name data-ops
           --bucket-file-path "ci_reports/report_${{ inputs.warehouse-type }}_${{ env.BRANCH_NAME }}.html"
-          --aws-access-key-id "$AWS_ACCESS_KEY_ID"
-          --aws-secret-access-key "$AWS_SECRET_ACCESS_KEY"
           --s3-bucket-name elementary-ci-artifacts
           --azure-connection-string "$AZURE_CONNECTION_STRING"
           --azure-container-name reports

tests/e2e_dbt_project/snapshots/failed_snapshot.sql

@@ -1,8 +1,9 @@
 {% snapshot failed_snapshot() %}
 
+{# target_schema is required by dbt; reuse target.schema so this lands in the per-run CI schema. #}
 {{
     config(
-      target_schema='snapshots',
+      target_schema=target.schema,
       unique_key='unique_id',
       strategy='timestamp',
       updated_at='generated_at',

tests/profiles/profiles.yml.j2

@@ -149,8 +149,7 @@ elementary_tests:
       region_name: {{ athena_region | toyaml }}
       database: awsdatacatalog
       schema: {{ schema_name }}
-      aws_access_key_id: {{ athena_aws_access_key_id | toyaml }}
-      aws_secret_access_key: {{ athena_aws_secret_access_key | toyaml }}
+      work_group: oss_tests
       threads: 4
 
 # The internal CLI dbt_project uses profile "elementary", so we alias the