OIDC keyless cloud auth

Job-level perms enabling OIDC token to assume a cloud role without static keys

permissions:
  id-token: write
  contents: read

More github-actions commands

Trigger workflow with inputs

gh workflow run deploy.yml -f env=prod -f version=1.4.2 --ref main

Dispatch a workflow_dispatch run passing typed inputs; note: needs workflow_dispatch trigger
Watch latest run live

gh run watch $(gh run list -w deploy.yml -L1 --json databaseId -q '.[0].databaseId')

Stream the newest run's progress live and exit with its status code
Show only failed logs

gh run view <id> --log-failed | less -R

Print logs of failed steps only, skipping noise from passing jobs
Run a job locally with act

act -j build --secret-file .secrets -P ubuntu-latest=catthehacker/ubuntu:act-22.04

Run an Actions job in Docker locally before pushing; note: pin a real runner image
Rerun only failed jobs

gh run rerun <id> --failed

Retry just the failed jobs of a run, reusing prior successful results