ci(bedrock): enable OIDC web identity recording (ogx-ai#6169)

## Summary
- add an optional Bedrock recording path for the STS web identity auth
introduced in ogx-ai#5388
- when AWS_BEDROCK_ROLE_ARN is configured, request a GitHub OIDC token
for sts.amazonaws.com and expose
AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE to the Bedrock provider
- keep the current bearer-token path as fallback when
AWS_BEDROCK_ROLE_ARN is not configured
- pass standard AWS credential-chain env vars through Docker integration
test runs

## Context
ogx-ai#6167 preserved compatibility between AWS_BEDROCK_BEARER_TOKEN and the
legacy AWS_BEARER_TOKEN_BEDROCK name. That PR is now merged.

The remaining question from the failed Bedrock re-record is whether CI
ever moved onto the STS/OIDC auth path from ogx-ai#5388. The provider already
supports SigV4 + web identity, but the record workflow did not prepare
AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE for Bedrock. This PR wires that
optional path without removing the bearer-token fallback.

To use it, configure an AWS_BEDROCK_ROLE_ARN repository secret for the
role trusted by GitHub Actions OIDC.

## Test Plan
- uv run pytest tests/unit/providers/inference/test_bedrock_config.py
tests/unit/providers/inference/bedrock/test_sigv4_auth.py -q
- uv run pre-commit run check-yaml --files
.github/workflows/record-integration-tests.yml
- uv run pre-commit run actionlint --files
.github/workflows/record-integration-tests.yml
- pre-commit via git commit hooks from original commit

Signed-off-by: Sumanth Kamenani <skamenan@redhat.com>

Author: skamenan7

.github/workflows/record-integration-tests.yml

@@ -283,6 +283,30 @@ jobs:
           suite: ${{ inputs.suite || matrix.provider.suite }}
           inference-mode: 'record-if-missing'
 
+      - name: Prepare AWS web identity for Bedrock
+        if: steps.should_run.outputs.run == 'true' && matrix.provider.setup == 'bedrock'
+        env:
+          AWS_BEDROCK_ROLE_ARN: ${{ secrets.AWS_BEDROCK_ROLE_ARN }}
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${AWS_BEDROCK_ROLE_ARN}" ]]; then
+            echo "AWS_BEDROCK_ROLE_ARN is not configured; using Bedrock bearer token or default AWS credential chain."
+            exit 0
+          fi
+
+          token_file="${RUNNER_TEMP}/bedrock-web-identity-token"
+          curl -fsSL \
+            -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sts.amazonaws.com" \
+            | jq -r '.value' > "${token_file}"
+
+          {
+            echo "AWS_ROLE_ARN=${AWS_BEDROCK_ROLE_ARN}"
+            echo "AWS_WEB_IDENTITY_TOKEN_FILE=${token_file}"
+            echo "AWS_DEFAULT_REGION=us-west-2"
+          } >> "${GITHUB_ENV}"
+
       - name: Run and record tests
         if: steps.should_run.outputs.run == 'true'
         uses: ogx-ai/ogx/.github/actions/run-and-record-tests@e1ba4f9f10fa45750f5b4f186a0c4ae59bc93e4d

scripts/integration-tests.sh

@@ -506,6 +506,12 @@ if [[ "$STACK_CONFIG" == *"docker:"* && "$COLLECT_ONLY" == false ]]; then
     [ -n "${AWS_BEDROCK_BEARER_TOKEN:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_BEDROCK_BEARER_TOKEN=$AWS_BEDROCK_BEARER_TOKEN"
     [ -n "${AWS_BEARER_TOKEN_BEDROCK:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_BEARER_TOKEN_BEDROCK=$AWS_BEARER_TOKEN_BEDROCK"
     [ -n "${AWS_DEFAULT_REGION:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION"
+    [ -n "${AWS_ACCESS_KEY_ID:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID"
+    [ -n "${AWS_SECRET_ACCESS_KEY:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY"
+    [ -n "${AWS_SESSION_TOKEN:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN"
+    [ -n "${AWS_ROLE_ARN:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_ROLE_ARN=$AWS_ROLE_ARN"
+    [ -n "${AWS_WEB_IDENTITY_TOKEN_FILE:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE"
+    [ -n "${AWS_ROLE_SESSION_NAME:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e AWS_ROLE_SESSION_NAME=$AWS_ROLE_SESSION_NAME"
     [ -n "${VERTEX_AI_PROJECT:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e VERTEX_AI_PROJECT=$VERTEX_AI_PROJECT"
     [ -n "${VERTEX_AI_LOCATION:-}" ] && DOCKER_ENV_VARS="$DOCKER_ENV_VARS -e VERTEX_AI_LOCATION=$VERTEX_AI_LOCATION"