alchemy 0.1.13 → 0.1.15

package/lib/github/secret.js

@@ -0,0 +1,103 @@
+import sodium from "libsodium-wrappers";
+import { Resource } from "../resource";
+import { createGitHubClient, verifyGitHubAuth } from "./client";
+/**
+ * Encrypt a value for GitHub using libsodium
+ * Based on GitHub's documentation for encrypting secrets
+ *
+ * @param value - The secret value to encrypt
+ * @param publicKey - The base64-encoded public key from GitHub
+ * @returns The base64-encoded encrypted value
+ */
+async function encryptValue(value, publicKey) {
+    // Initialize libsodium
+    await sodium.ready;
+    // Convert the public key from base64 to binary
+    const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+    // Convert the message to a Uint8Array
+    const binMessage = sodium.from_string(value);
+    // Encrypt the message with the public key using libsodium's sealed box
+    const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
+    // Convert the encrypted message to base64
+    return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
+}
+/**
+ * Resource for managing GitHub repository secrets
+ */
+export class GitHubSecret extends Resource("github::Secret", async (ctx, props) => {
+    // Create authenticated Octokit client - will automatically handle token resolution
+    const octokit = await createGitHubClient({ token: props.token });
+    // Verify authentication and permissions
+    if (!ctx.quiet) {
+        await verifyGitHubAuth(octokit, props.owner, props.repository);
+    }
+    if (ctx.event === "delete") {
+        if (ctx.output?.id) {
+            try {
+                // Delete the secret
+                await octokit.rest.actions.deleteRepoSecret({
+                    owner: props.owner,
+                    repo: props.repository,
+                    secret_name: props.name,
+                });
+            }
+            catch (error) {
+                // Ignore 404 errors (secret already deleted)
+                if (error.status === 404) {
+                    console.log("Secret doesn't exist, ignoring");
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        // Return void (a deleted resource has no content)
+        return undefined;
+    }
+    else {
+        try {
+            // Get the repository's public key for encrypting secrets
+            const { data: publicKey } = await octokit.rest.actions.getRepoPublicKey({
+                owner: props.owner,
+                repo: props.repository,
+            });
+            // Encrypt the secret value using libsodium
+            const encryptedValue = await encryptValue(props.value, publicKey.key);
+            // Create or update the secret with the encrypted value and key_id
+            const response = await octokit.rest.actions.createOrUpdateRepoSecret({
+                owner: props.owner,
+                repo: props.repository,
+                secret_name: props.name,
+                encrypted_value: encryptedValue,
+                key_id: publicKey.key_id,
+            });
+            // Log success
+            if (!ctx.quiet) {
+                console.log(`Successfully created/updated secret: ${props.name}`);
+            }
+            // GitHub doesn't return the secret details on create/update, so we need to construct it
+            const output = {
+                id: `${props.owner}/${props.repository}/${props.name}`,
+                owner: props.owner,
+                repository: props.repository,
+                name: props.name,
+                token: props.token,
+                updatedAt: new Date().toISOString(),
+            };
+            return output;
+        }
+        catch (error) {
+            if (error.status === 403 &&
+                error.message?.includes("Must have admin rights")) {
+                console.error("\n⚠️ Error creating/updating GitHub secret: You must have admin rights to the repository.");
+                console.error("Make sure your GitHub token has the required permissions (repo scope for private repos).\n");
+            }
+            else {
+                console.error("Error creating/updating GitHub secret:", error.message);
+            }
+            throw error;
+        }
+    }
+}) {
+}
+//# sourceMappingURL=secret.js.map

package/lib/github/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/github/secret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAgB,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AA+ChE;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,SAAiB;IAC1D,uBAAuB;IACvB,MAAM,MAAM,CAAC,KAAK,CAAC;IAEnB,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE9E,sCAAsC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAE7C,uEAAuE;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEhE,0CAA0C;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,QAAQ,CACxC,gBAAgB,EAChB,KAAK,EACH,GAAgC,EAChC,KAAwB,EACY,EAAE;IACtC,mFAAmF;IACnF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAEjE,wCAAwC;IACxC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,oBAAoB;gBACpB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,6CAA6C;gBAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,yDAAyD;YACzD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACrE;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;aACvB,CACF,CAAC;YAEF,2CAA2C;YAC3C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;YAEtE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;gBACnE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,cAAc;gBAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;YAEH,cAAc;YACd,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,wCAAwC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,wFAAwF;YACxF,MAAM,MAAM,GAAuB;gBACjC,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE;gBACtD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IACE,KAAK,CAAC,MAAM,KAAK,GAAG;gBACpB,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,EACjD,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,2FAA2F,CAC5F,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,4FAA4F,CAC7F,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,wCAAwC,EACxC,KAAK,CAAC,OAAO,CACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CACF;CAAG"}

package/lib/utils/retry.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Utility function for exponential backoff retry
+ * Retries an operation with exponential backoff when a retryable error occurs
+ *
+ * @param operation The async operation to execute and potentially retry
+ * @param isRetryable Function to determine if an error should trigger a retry
+ * @param maxAttempts Maximum number of attempts before giving up
+ * @param initialDelayMs Initial delay in milliseconds before first retry
+ * @returns Result of the operation
+ * @throws The last error encountered if all retries fail
+ */
+export declare function withExponentialBackoff<T>(operation: () => Promise<T>, isRetryable: (error: any) => boolean, maxAttempts?: number, initialDelayMs?: number): Promise<T>;
+//# sourceMappingURL=retry.d.ts.map

package/lib/utils/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/utils/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,EACpC,WAAW,SAAI,EACf,cAAc,SAAM,GACnB,OAAO,CAAC,CAAC,CAAC,CAoBZ"}

package/lib/utils/retry.js

@@ -0,0 +1,32 @@
+/**
+ * Utility function for exponential backoff retry
+ * Retries an operation with exponential backoff when a retryable error occurs
+ *
+ * @param operation The async operation to execute and potentially retry
+ * @param isRetryable Function to determine if an error should trigger a retry
+ * @param maxAttempts Maximum number of attempts before giving up
+ * @param initialDelayMs Initial delay in milliseconds before first retry
+ * @returns Result of the operation
+ * @throws The last error encountered if all retries fail
+ */
+export async function withExponentialBackoff(operation, isRetryable, maxAttempts = 5, initialDelayMs = 100) {
+    let attempt = 0;
+    let delay = initialDelayMs;
+    while (true) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            attempt++;
+            if (attempt >= maxAttempts || !isRetryable(error)) {
+                console.warn("Failed after ", attempt, " attempts");
+                throw error;
+            }
+            // Exponential backoff with jitter
+            const jitter = Math.random() * 0.1 * delay;
+            await new Promise((resolve) => setTimeout(resolve, delay + jitter));
+            delay *= 2; // Double the delay for next attempt
+        }
+    }
+}
+//# sourceMappingURL=retry.js.map

package/lib/utils/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/utils/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,WAAoC,EACpC,WAAW,GAAG,CAAC,EACf,cAAc,GAAG,GAAG;IAEpB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,GAAG,cAAc,CAAC;IAE3B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IAAI,OAAO,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,kCAAkC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC;YAC3C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;YACpE,KAAK,IAAI,CAAC,CAAC,CAAC,oCAAoC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "alchemy",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "type": "module",
   "module": "./lib/index.js",
   "scripts": {
-    "check": "tsc -b ./tsconfig.all.json",
     "publish:npm": "rm -rf ./lib && tsc -b && npm publish"
   },
   "files": ["lib", "src"],
@@ -12,10 +11,12 @@
     ".": "./lib/index.js",
     "./agent": "./lib/agent/index.js",
     "./aws": "./lib/aws/index.js",
+    "./aws/oidc": "./lib/aws/oidc/index.js",
     "./cloudflare": "./lib/cloudflare/index.js",
     "./esbuild": "./lib/esbuild.js",
     "./markdown": "./lib/markdown/index.js",
     "./fs": "./lib/fs.js",
+    "./github": "./lib/github/index.js",
     "./stripe": "./lib/stripe/index.js",
     "./typescript": "./lib/typescript/index.js"
   },
@@ -28,12 +29,15 @@
     "@aws-sdk/client-sagemaker": "^3.0.0",
     "@aws-sdk/client-ses": "^3.0.0",
     "@aws-sdk/client-sesv2": "^3.0.0",
-    "@aws-sdk/client-sqs": "^3.0.1",
+    "@aws-sdk/client-sqs": "^3.0.0",
+    "@aws-sdk/client-sts": "^3.0.0",
+    "@octokit/rest": "^21.1.1",
     "ai": "^4.1.16",
     "diff": "^7.0.0",
     "esbuild": "^0.24.2",
     "glob": "^10.3.10",
     "hono": "^4.7.4",
+    "libsodium-wrappers": "^0.7.15",
     "jszip": "^3.0.0",
     "stripe": "^17.7.0",
     "turndown": "^7.2.0",
@@ -44,12 +48,15 @@
     "@ai-sdk/openai": "^1.1.9",
     "@biomejs/biome": "^1.9.4",
     "@cloudflare/workers-types": "^4.20250303.0",
+    "@octokit/rest": "^21.1.1",
     "@types/bun": "latest",
     "@types/diff": "^5.0.0",
+    "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "latest",
     "@types/turndown": "^5.0.5",
     "ai": "^4.1.16",
     "change-case": "^5.4.4",
+    "libsodium-wrappers": "^0.7.15",
     "openpgp": "^6.1.0",
     "turndown": "^7.2.0",
     "typescript": "latest",

package/src/aws/account-id.ts

@@ -0,0 +1,11 @@
+import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+
+const sts = new STSClient({});
+
+/**
+ * Helper to get the current AWS account ID
+ */
+export async function getAccountId(): Promise<string> {
+  const identity = await sts.send(new GetCallerIdentityCommand({}));
+  return identity.Account!;
+}

package/src/aws/index.ts

@@ -1,3 +1,4 @@
+export * from "./account-id";
 export * from "./bucket";
 export * from "./function";
 export * from "./policy";

package/src/aws/oidc/github-oidc-provider.ts

@@ -0,0 +1,34 @@
+import type { Input } from "../../input";
+import { isOutput } from "../../output";
+import { OIDCProvider, type OIDCProviderProps } from "./oidc-provider";
+
+/**
+ * Default thumbprint for GitHub's OIDC provider
+ * This is the certificate thumbprint that GitHub uses to sign OIDC tokens
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws
+ */
+const DEFAULT_GITHUB_THUMBPRINT = "6938fd4d98bab03faadb97b34396831e3780aea1";
+
+export interface GitHubOIDCProviderProps
+  extends Omit<OIDCProviderProps, "thumbprint"> {
+  owner: string;
+  repository: string;
+  thumbprint?: string;
+}
+
+export class GitHubOIDCProvider extends OIDCProvider {
+  constructor(id: string, props: Input<GitHubOIDCProviderProps>) {
+    super(
+      id,
+      isOutput<GitHubOIDCProviderProps>(props)
+        ? props.apply((props) => ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          }))
+        : ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          } as Input<OIDCProviderProps>),
+    );
+  }
+}

package/src/aws/oidc/index.ts

@@ -0,0 +1,2 @@
+export * from "./github-oidc-provider";
+export * from "./oidc-provider";

package/src/aws/oidc/oidc-provider.ts

@@ -0,0 +1,253 @@
+import {
+  CreateOpenIDConnectProviderCommand,
+  DeleteOpenIDConnectProviderCommand,
+  GetOpenIDConnectProviderCommand,
+  GetRoleCommand,
+  IAMClient,
+  type Tag,
+  UpdateAssumeRolePolicyCommand,
+} from "@aws-sdk/client-iam";
+import { type Context, Resource } from "../../resource";
+import { getAccountId } from "../account-id";
+
+/**
+ * Properties for configuring an AWS OIDC provider for GitHub Actions
+ */
+export interface OIDCProviderProps {
+  /**
+   * The GitHub organization or user that owns the repository
+   */
+  owner: string;
+
+  /**
+   * The name of the GitHub repository
+   */
+  repository: string;
+
+  /**
+   * Optional list of branches to restrict access to
+   * If not provided, all branches will be allowed
+   */
+  branches?: string[];
+
+  /**
+   * Optional list of environments to restrict access to
+   * If not provided, all environments will be allowed
+   */
+  environments?: string[];
+
+  /**
+   * The ARN of the IAM role to be assumed
+   */
+  roleArn: string;
+
+  /**
+   * Optional maximum session duration in seconds (default: 3600)
+   */
+  maxSessionDuration?: number;
+
+  /**
+   * Thumbprint for the OIDC provider
+   */
+  thumbprint: string;
+
+  /**
+   * Optional AWS region (defaults to AWS_REGION environment variable)
+   */
+  region?: string;
+}
+
+/**
+ * Output returned after OIDC provider configuration
+ */
+export interface OIDCProviderOutput extends OIDCProviderProps {
+  /**
+   * The ARN of the OIDC provider
+   */
+  providerArn: string;
+
+  /**
+   * Time at which the provider was created
+   */
+  createdAt: number;
+}
+
+/**
+ * Unique identifier for our trust policy statement
+ * Used to track and remove our specific statement without affecting others
+ */
+const TRUST_POLICY_SID = "GitHubOIDCTrust";
+
+/**
+ * Resource for configuring AWS OIDC provider for GitHub Actions
+ */
+export class OIDCProvider extends Resource(
+  "aws::OIDCProvider",
+  async (ctx: Context<OIDCProviderOutput>, props: OIDCProviderProps) => {
+    // Initialize AWS SDK client
+    const client = new IAMClient({
+      region: props.region,
+    });
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.providerArn) {
+        try {
+          // First, remove our trust policy statement from the role
+          const getRole = await client.send(
+            new GetRoleCommand({
+              RoleName: props.roleArn.split("/").pop(),
+            }),
+          );
+
+          if (getRole.Role?.AssumeRolePolicyDocument) {
+            const policy = JSON.parse(
+              decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+            );
+
+            // Remove our specific statement while preserving others
+            policy.Statement = policy.Statement.filter(
+              (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+            );
+
+            await client.send(
+              new UpdateAssumeRolePolicyCommand({
+                RoleName: props.roleArn.split("/").pop(),
+                PolicyDocument: JSON.stringify(policy),
+              }),
+            );
+          }
+
+          // Then delete the OIDC provider if we're the last user
+          const provider = await client.send(
+            new GetOpenIDConnectProviderCommand({
+              OpenIDConnectProviderArn: ctx.output.providerArn,
+            }),
+          );
+
+          // Only delete the provider if it exists and has no other tags
+          if (provider && (!provider.Tags || provider.Tags.length === 0)) {
+            await client.send(
+              new DeleteOpenIDConnectProviderCommand({
+                OpenIDConnectProviderArn: ctx.output.providerArn,
+              }),
+            );
+          }
+        } catch (error) {
+          // Log but don't throw on cleanup errors
+          console.error("Error during cleanup:", error);
+        }
+      }
+      return;
+    }
+
+    try {
+      const url = "https://token.actions.githubusercontent.com";
+      const thumbprint = props.thumbprint;
+
+      // Create or get existing OIDC provider
+      let providerArn: string;
+      try {
+        const createProvider = await client.send(
+          new CreateOpenIDConnectProviderCommand({
+            Url: url,
+            ClientIDList: ["sts.amazonaws.com"],
+            ThumbprintList: [thumbprint],
+            Tags: [
+              {
+                Key: "ManagedBy",
+                Value: "alchemy",
+              },
+            ] as Tag[],
+          }),
+        );
+        providerArn = createProvider.OpenIDConnectProviderArn!;
+      } catch (error: any) {
+        if (error.name === "EntityAlreadyExistsException") {
+          // Provider exists, use its ARN
+          providerArn = `arn:aws:iam::${await getAccountId()}:oidc-provider/${url}`;
+        } else {
+          throw error;
+        }
+      }
+
+      // Get current role policy
+      const getRole = await client.send(
+        new GetRoleCommand({
+          RoleName: props.roleArn.split("/").pop(),
+        }),
+      );
+
+      let policy: any;
+      if (getRole.Role?.AssumeRolePolicyDocument) {
+        policy = JSON.parse(
+          decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+        );
+      } else {
+        policy = {
+          Version: "2012-10-17",
+          Statement: [],
+        };
+      }
+
+      // Construct the trust policy conditions
+      const conditions: Record<string, any> = {
+        StringEquals: {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:sub": `repo:${props.owner}/${props.repository}:`,
+        },
+      };
+
+      if (props.branches?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.branches.map(
+            (branch) =>
+              `repo:${props.owner}/${props.repository}:ref:refs/heads/${branch}`,
+          );
+      }
+
+      if (props.environments?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.environments.map(
+            (env) =>
+              `repo:${props.owner}/${props.repository}:environment:${env}`,
+          );
+      }
+
+      // Create our policy statement
+      const ourStatement = {
+        Sid: TRUST_POLICY_SID,
+        Effect: "Allow",
+        Principal: {
+          Federated: providerArn,
+        },
+        Action: "sts:AssumeRoleWithWebIdentity",
+        Condition: conditions,
+      };
+
+      // Remove any existing statement with our SID and add the new one
+      policy.Statement = [
+        ...policy.Statement.filter(
+          (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+        ),
+        ourStatement,
+      ];
+
+      // Update the role's trust policy
+      await client.send(
+        new UpdateAssumeRolePolicyCommand({
+          RoleName: props.roleArn.split("/").pop(),
+          PolicyDocument: JSON.stringify(policy),
+        }),
+      );
+
+      return {
+        ...props,
+        providerArn,
+        createdAt: Date.now(),
+      };
+    } catch (error) {
+      console.error("Error configuring OIDC provider:", error);
+      throw error;
+    }
+  },
+) {}

package/src/aws/queue.ts

@@ -8,14 +8,30 @@ import {
 import { Resource } from "../resource";
 
 export interface QueueProps {
+  /**
+   * Name of the queue
+   * For FIFO queues, the name must end with the .fifo suffix
+   */
   queueName: string;
+
+  /**
+   * Whether this is a FIFO queue.
+   * If true, the queueName must end with .fifo suffix
+   */
   fifo?: boolean;
+
   visibilityTimeout?: number;
   messageRetentionPeriod?: number;
   maximumMessageSize?: number;
   delaySeconds?: number;
   receiveMessageWaitTimeSeconds?: number;
+
+  /**
+   * Enables content-based deduplication for FIFO queues.
+   * Only applicable when fifo is true.
+   */
   contentBasedDeduplication?: boolean;
+
   deduplicationScope?: "messageGroup" | "queue";
   fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
   tags?: Record<string, string>;
@@ -31,7 +47,13 @@ export class Queue extends Resource(
   "sqs::Queue",
   async (ctx, props: QueueProps) => {
     const client = new SQSClient({});
-    const queueName = props.fifo ? `${props.queueName}.fifo` : props.queueName;
+    // Don't automatically add .fifo suffix - user must include it in queueName
+    const queueName = props.queueName;
+
+    // Validate that FIFO queues have .fifo suffix
+    if (props.fifo && !queueName.endsWith(".fifo")) {
+      throw new Error("FIFO queue names must end with .fifo suffix");
+    }
 
     if (ctx.event === "delete") {
       try {

package/src/aws/role.ts

@@ -1,10 +1,13 @@
 import {
+  AttachRolePolicyCommand,
   CreateRoleCommand,
   DeleteRoleCommand,
   DeleteRolePolicyCommand,
+  DetachRolePolicyCommand,
   EntityAlreadyExistsException,
   GetRoleCommand,
   IAMClient,
+  ListAttachedRolePoliciesCommand,
   NoSuchEntityException,
   PutRolePolicyCommand,
   type Tag,
@@ -59,6 +62,32 @@ export class Role extends Resource(
         }
       }
 
+      // We need to detach managed policies before deleting the role
+      // First, get all attached policies
+      try {
+        const attachedPoliciesResponse = await client.send(
+          new ListAttachedRolePoliciesCommand({
+            RoleName: props.roleName,
+          }),
+        );
+
+        // Detach all managed policies
+        const attachedPolicies =
+          attachedPoliciesResponse.AttachedPolicies || [];
+        for (const policy of attachedPolicies) {
+          await client.send(
+            new DetachRolePolicyCommand({
+              RoleName: props.roleName,
+              PolicyArn: policy.PolicyArn!,
+            }),
+          );
+        }
+      } catch (error: any) {
+        if (error.name !== NoSuchEntityException.name) {
+          throw error;
+        }
+      }
+
       await ignore(NoSuchEntityException.name, () =>
         client.send(
           new DeleteRoleCommand({
@@ -229,6 +258,46 @@ export class Role extends Resource(
       }
     }
 
+    // Handle managed policy attachments
+    // Get currently attached policies
+    const attachedPoliciesResponse = await client.send(
+      new ListAttachedRolePoliciesCommand({
+        RoleName: props.roleName,
+      }),
+    );
+
+    const currentAttachedPolicies =
+      attachedPoliciesResponse.AttachedPolicies || [];
+    const currentPolicyArns = currentAttachedPolicies.map((p) => p.PolicyArn!);
+
+    // If we're updating, use an empty array as default when managedPolicyArns is undefined
+    // to ensure we detach all managed policies
+    const desiredPolicyArns = props.managedPolicyArns || [];
+
+    // Detach policies that are no longer needed
+    for (const policyArn of currentPolicyArns) {
+      if (!desiredPolicyArns.includes(policyArn)) {
+        await client.send(
+          new DetachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
+    // Attach new policies that weren't attached before
+    for (const policyArn of desiredPolicyArns) {
+      if (!currentPolicyArns.includes(policyArn)) {
+        await client.send(
+          new AttachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
     if (!role?.Role) {
       throw new Error(`Failed to create or update role ${props.roleName}`);
     }