fix(monitor): use Aliyun OIDC credentials

[proerror77]

Change contract

Authenticate the collector-host monitor through GitHub OIDC and the pinned official Aliyun credential action, yielding temporary STS credentials for the existing CLI calls without long-lived AccessKeys.

Issue relationship

Refs #738

Out of scope

Provisioning or changing the Aliyun OIDC provider, RAM role, trust policy, or cloud permissions; configuring repository variables; deleting existing repository secrets; changing the target instance, region, Cloud Assistant command, health semantics, gate, cutover, or production runtime.

Dependencies and merge order

PR #762 is merged. Before this workflow runs from main, ALIYUN_COLLECTOR_MONITOR_OIDC_PROVIDER_ARN and ALIYUN_COLLECTOR_MONITOR_ROLE_ARN repository variables must identify an already-provisioned trust and role restricted to the documented instance and Cloud Assistant operations. Missing or rejected OIDC configuration fails the job closed.

Focused validation

• Red before fix: monitor contract reported missing GitHub OIDC permission, missing pinned Aliyun exchange, and continued long-term AccessKey dependency.
• bash .github/scripts/test-monitor-collector-host.sh
• bash .github/scripts/test-select-rust-ci-scope.sh
• shellcheck .github/scripts/test-monitor-collector-host.sh
• Ruby YAML parse for .github/workflows/monitor-collector-host.yml
• actionlint for monitor and Prediction Markets workflows
• git diff --check origin/main...HEAD

Rollout and rollback

No cloud or production mutation in this PR. Merge changes authentication on the next scheduled/manual monitor run. Revert this commit to roll back the code path; do not weaken the existing fail-closed health behavior.

Scope exception

None.

[coderabbitai]

Warning

Review limit reached

@proerror77, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 983a2abb-1c84-45e4-a7ae-5c2c462e8982

📥 Commits

Reviewing files that changed from the base of the PR and between 74b4f32 and 7475364.

📒 Files selected for processing (2)

• .github/scripts/test-monitor-collector-host.sh
• .github/workflows/monitor-collector-host.yml

📝 Walkthrough

Walkthrough

The monitor collector workflow now uses GitHub OIDC to obtain temporary Aliyun credentials. Repository variables define the provider and role. A validation script checks the required OIDC configuration and rejects static AccessKeys.

Changes

Monitor collector OIDC migration

Layer / File(s)	Summary
Configure OIDC workflow authentication .github/workflows/monitor-collector-host.yml	The workflow documents the required OIDC variables, grants id-token: write, installs the CLI separately, and uses the pinned Aliyun credentials action with the configured role and STS audience.
Validate OIDC contract .github/scripts/test-monitor-collector-host.sh	The validation script checks the OIDC permission, action settings, provider and role variables, audience, and absence of long-term Aliyun AccessKeys.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• proerror77/monday#735: Updates the same workflow from static Aliyun credentials to OIDC authentication and adds contract validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely states that the monitor replaces Aliyun AccessKeys with OIDC.
Description check	✅ Passed	The description completes every required template section and documents scope, dependencies, validation, rollout, and rollback.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/collector-monitor-oidc-738

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/test-monitor-collector-host.sh:
- Around line 20-23: Expand the matcher in the workflow credential check to
reject any `aliyun configure` usage, the `--access-key-id` and
`--access-key-secret` CLI flags, and standard Alibaba Cloud AccessKey
environment names in addition to the existing patterns. Keep the failure
behavior through `oidc_contract_failed=1` unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eb776d05-53ee-456f-8fde-be9e705c3457

📥 Commits

Reviewing files that changed from the base of the PR and between ff4c545 and 74b4f32.

📒 Files selected for processing (2)

• .github/scripts/test-monitor-collector-host.sh
• .github/workflows/monitor-collector-host.yml

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74b4f326db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".