### Configure Role Session Name Example

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Example of a valid role-session-name configuration using the GitHub run ID.

```yaml
role-session-name: GitHubActions-${{ github.run_id }}
```

--------------------------------

### Configure AWS Credentials with Custom Audience

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Example of setting the audience and region for AWS China when using OIDC.

```yaml
- name: Configure AWS Credentials for China region audience
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    audience: sts.amazonaws.com.cn
    aws-region: cn-northwest-1
    role-to-assume: arn:aws-cn:iam::123456789100:role/my-github-actions-role
```

--------------------------------

### Configure AWS Credentials in GitHub Workflow

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Example GitHub Actions workflow step using the aws-actions/configure-aws-credentials action. Requires id-token: write permissions.

```yaml
# Need ID token write permission to use OIDC
permissions:
  id-token: write
jobs:
  run_job_with_aws:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6.2.3
        with:
          role-to-assume: <Role ARN you created in step 2>
          aws-region: <AWS Region you want to use>
      - name: Additional steps
        run: |
          # Your commands that require AWS credentials
          aws sts get-caller-identity
```

--------------------------------

### Compare Legacy and Immutable Subject Claims

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Examples of the format difference between mutable legacy sub claims and the newer immutable sub claims used in IAM trust policies.

```text
# Legacy (mutable) sub claim
repo:octo-org/octo-repo:ref:refs/heads/main

# Immutable sub claim
repo:octo-org@123456/octo-repo@789012:ref:refs/heads/main
```

--------------------------------

### Get profile file paths

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Retrieves the absolute paths for the AWS credentials and config files, respecting environment variable overrides.

```typescript
export function getProfileFilePaths(): { credentials: string; config: string }
```

--------------------------------

### Run Action Entry Point

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Orchestrates the complete GitHub Actions credential configuration workflow.

```typescript
export async function run(): Promise<void>
```

--------------------------------

### Get Caller Identity

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Validates credentials and resolves caller identity by calling the STS GetCallerIdentity API.

```typescript
export async function getCallerIdentity(
  client: STSClient,
): Promise<{ Account: string; Arn: string; UserId?: string }>
```

--------------------------------

### mkdir()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Creates a directory with secure permissions.

```APIDOC
## mkdir(dir: string, mode?: number)

### Description
Creates a directory recursively with secure permissions, refusing symlinks.

### Parameters
- **dir** (string) - Required - Directory path
- **mode** (number) - Optional - Directory permissions (Default: 0o700)
```

--------------------------------

### Retrieve and use credentials from step outputs

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Demonstrates how to set output-credentials to true to access credentials as step outputs, allowing them to be passed to subsequent steps.

```yaml
- name: Configure AWS Credentials 1
  id: creds
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    output-credentials: true
- name: get caller identity 1
  run: |
    aws sts get-caller-identity
- name: Configure AWS Credentials 2
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
    aws-secret-access-key: ${{ steps.creds.outputs.aws-secret-access-key }}
    aws-session-token: ${{ steps.creds.outputs.aws-session-token }}
    role-to-assume: arn:aws:iam::123456789100:role/my-other-github-actions-role
- name: get caller identity2
  run: |
    aws sts get-caller-identity
```

--------------------------------

### run()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

The run() function orchestrates the complete credential configuration workflow, including OIDC authentication, IAM role assumption, and credential export.

```APIDOC
## run()

### Description
Orchestrates the complete credential configuration workflow for GitHub Actions. It reads inputs, validates credentials, optionally assumes an IAM role, and exports credentials as environment variables or outputs.

### Signature
`export async function run(): Promise<void>`

### Inputs (via @actions/core)
- **aws-region** (string) - Required - AWS region identifier
- **aws-access-key-id** (string) - Optional - Static access key ID
- **aws-secret-access-key** (string) - Optional - Static secret access key
- **aws-session-token** (string) - Optional - Static session token
- **role-to-assume** (string) - Optional - ARN of role to assume
- **aws-profile** (string) - Optional - Profile name for credential file writing
- **role-duration-seconds** (number) - Optional - Assumed role duration (default: 3600)
- **role-session-name** (string) - Optional - Session name (default: "GitHubActions")

### Outputs (via @actions/core)
- **aws-account-id** (string) - AWS account ID
- **authenticated-arn** (string) - ARN of authenticated principal
- **aws-access-key-id** (string) - Access key ID
- **aws-secret-access-key** (string) - Secret access key
- **aws-session-token** (string) - Session token
- **aws-expiration** (string) - Credential expiration time
```

--------------------------------

### Main Entry Point Dependencies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Core imports required for the action's main execution flow.

```typescript
import * as core from '@actions/core'
import type { AssumeRoleCommandOutput } from '@aws-sdk/client-sts'
import { assumeRole } from './assumeRole'
import { CredentialsClient } from './CredentialsClient'
import { /* 11 helper functions */ } from './helpers'
import { writeProfileFiles } from './profileManager'
```

--------------------------------

### Optional Configuration Inputs

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

Additional settings for customizing session duration, tags, and proxy configurations.

```yaml
aws-profile: string                       # Profile name for files
role-duration-seconds: number             # Session duration (default: 3600)
custom-tags: JSON string                  # Custom session tags
inline-session-policy: JSON string        # Restrict permissions
http-proxy: string                        # HTTP proxy URL
action-timeout-s: number                  # Global timeout
... and 25+ more options
```

--------------------------------

### Map Environment Variables to Action Inputs

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Lists the mapping pattern where standard environment variables are translated to INPUT_* format for the action.

```bash
AWS_REGION                  → INPUT_AWS-REGION
ROLE_TO_ASSUME              → INPUT_ROLE-TO-ASSUME
WEB_IDENTITY_TOKEN_FILE     → INPUT_WEB-IDENTITY-TOKEN-FILE
ROLE_CHAINING               → INPUT_ROLE-CHAINING
AUDIENCE                    → INPUT_AUDIENCE
HTTP_PROXY                  → INPUT_HTTP-PROXY
MASK_AWS_ACCOUNT_ID         → INPUT_MASK-AWS-ACCOUNT-ID
ROLE_DURATION_SECONDS       → INPUT_ROLE-DURATION-SECONDS
ROLE_EXTERNAL_ID            → INPUT_ROLE-EXTERNAL-ID
ROLE_SESSION_NAME           → INPUT_ROLE-SESSION-NAME
ROLE_SKIP_SESSION_TAGGING   → INPUT_ROLE-SKIP-SESSION-TAGGING
TRANSITIVE_TAG_KEYS         → INPUT_TRANSITIVE-TAG-KEYS
INLINE_SESSION_POLICY       → INPUT_INLINE-SESSION-POLICY
MANAGED_SESSION_POLICIES    → INPUT_MANAGED-SESSION-POLICIES
OUTPUT_CREDENTIALS          → INPUT_OUTPUT-CREDENTIALS
UNSET_CURRENT_CREDENTIALS   → INPUT_UNSET-CURRENT-CREDENTIALS
DISABLE_RETRY               → INPUT_DISABLE-RETRY
RETRY_MAX_ATTEMPTS          → INPUT_RETRY-MAX-ATTEMPTS
SPECIAL_CHARACTERS_WORKAROUND → INPUT_SPECIAL-CHARACTERS-WORKAROUND
USE_EXISTING_CREDENTIALS    → INPUT_USE-EXISTING-CREDENTIALS
NO_PROXY                    → INPUT_NO-PROXY
OVERWRITE_AWS_PROFILE       → INPUT_OVERWRITE-AWS-PROFILE
```

--------------------------------

### Configure Proxy and Endpoint Settings

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for defining proxy servers and custom STS endpoints.

```text
http-proxy
no-proxy
sts-endpoint
```

--------------------------------

### constructor(props: CredentialsClientProps)

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Initializes a new instance of the CredentialsClient with configuration for region, proxy settings, and STS endpoints.

```APIDOC
## constructor(props: CredentialsClientProps)

### Description
Initializes the STS client configuration, including optional proxy handling and environment variable setup.

### Parameters
- **region** (string) - Optional - AWS region for STS client
- **proxyServer** (string) - Optional - HTTP/HTTPS proxy URL
- **noProxy** (string) - Optional - Comma-separated hosts to skip proxy
- **stsEndpoint** (string) - Optional - Custom STS endpoint URL
- **roleChaining** (boolean) - Required - Enable role chaining mode
```

--------------------------------

### Configuration Limits

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Defined constraints for tags, session duration, and naming.

```text
MAX_TAG_KEY_LENGTH: 128
MAX_TAG_VALUE_LENGTH: 256
MAX_SESSION_TAGS: 50
DEFAULT_ROLE_DURATION: 3600 (seconds)
Role Duration Range: 900 (15 min) to 43200 (12 hours)
Role Session Name Length: 2-64 characters
```

--------------------------------

### Configure multiple AWS profiles

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Shows how to use the aws-profile input to write credentials to local configuration files, enabling the use of the --profile flag for CLI and SDK operations.

```yaml
- name: Configure AWS Credentials for Dev
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::111111111111:role/dev-role
    aws-profile: dev

- name: Configure AWS Credentials for Prod
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-west-2
    role-to-assume: arn:aws:iam::222222222222:role/prod-role
    aws-profile: prod

- name: Use multiple profiles
  run: |
    # Check caller identity for dev account
    aws sts get-caller-identity --profile dev

    # Check caller identity for prod account
    aws sts get-caller-identity --profile prod

    # Deploy to dev using CDK
    cdk deploy --profile dev
```

--------------------------------

### Configure Authentication Parameters

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Required and optional parameters for setting up AWS authentication.

```text
aws-region (required)
aws-access-key-id
aws-secret-access-key
aws-session-token
role-to-assume
web-identity-token-file
role-chaining
audience
```

--------------------------------

### Configure Output Options

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters controlling how credentials are exported and masked.

```text
output-credentials
output-env-credentials (default: true unless aws-profile set)
mask-aws-account-id
```

--------------------------------

### Simulate GitHub Actions Environment Variables

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

Use these environment variables to simulate the GitHub Actions runtime environment during local development and testing.

```bash
export GITHUB_REPOSITORY="org/repo"
export GITHUB_WORKFLOW="workflow"
export GITHUB_ACTION="action"
export GITHUB_ACTOR="actor"
export GITHUB_SHA="abc123"
export GITHUB_WORKSPACE="/path/to/workspace"
```

--------------------------------

### Enable Debug Logging

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Set the SHOW_STACK_TRACE environment variable to true to output full stack traces. Avoid using this in production environments to prevent leaking sensitive information.

```yaml
env:
  SHOW_STACK_TRACE: "true"
```

--------------------------------

### Create Directory Securely

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Creates a directory recursively with specific permissions and validates that the path is not a symlink.

```typescript
export function mkdir(dir: string, mode?: number): void
```

--------------------------------

### Configure Session Policies and Tags

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Apply inline session policies and custom tags when assuming a role.

```yaml
with:
  aws-region: us-east-1
  role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
  role-duration-seconds: 1800
  inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}'
  custom-tags: '{"Environment":"Production","CostCenter":"1234"}'
```

--------------------------------

### Initialize ProxyResolver

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Constructor for the ProxyResolver class requiring ProxyOptions configuration.

```typescript
constructor(options: ProxyOptions)
```

--------------------------------

### Configure Security Settings

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for restricting account IDs and forcing OIDC skip behavior.

```text
allowed-account-ids
force-skip-oidc
```

--------------------------------

### Configure Role Options

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for customizing assumed role sessions, including duration, session names, and tagging.

```text
role-duration-seconds (default: 3600)
role-session-name (default: GitHubActions)
role-external-id
role-skip-session-tagging
transitive-tag-keys
custom-tags
inline-session-policy
managed-session-policies
```

--------------------------------

### Define ProxyOptions

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/types.md

Configuration settings for HTTP/HTTPS proxy connectivity.

```typescript
interface ProxyOptions {
  readonly noProxy?: string;
  readonly httpsProxy?: string;
  readonly httpProxy?: string;
}
```

--------------------------------

### Project Module Structure

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Visual representation of the source directory organization.

```text
src/
├── index.ts                    # Main action entry point (run function)
├── CredentialsClient.ts        # STS client wrapper with proxy support
├── assumeRole.ts               # IAM role assumption orchestration
├── helpers.ts                  # Utility functions (credentials, validation, I/O)
├── profileManager.ts           # AWS profile file management (INI parsing/writing)
├── ProxyResolver.ts            # HTTP proxy resolution logic
└── cleanup/
    └── index.ts                # Post-job cleanup function
```

--------------------------------

### Initialize CredentialsClient

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Constructor for initializing the STS client configuration with optional proxy settings and role chaining.

```typescript
constructor(props: CredentialsClientProps)
```

--------------------------------

### Default Configuration Values

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Default settings used when no specific configuration is provided.

```text
ROLE_SESSION_NAME: "GitHubActions"
AUDIENCE: "sts.amazonaws.com"
RETRY_MAX_ATTEMPTS: 12
RETRY_BASE_DELAY: 50ms
OUTPUT_ENV_CREDENTIALS: true (unless aws-profile set)
FILE_MODE: 0o600
DIRECTORY_MODE: 0o700
```

--------------------------------

### Configure Profile Settings

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for managing AWS profile selection and overwriting behavior.

```text
aws-profile
overwrite-aws-profile
```

--------------------------------

### Configure HTTP Proxy

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Define proxy settings either directly in the action configuration or via environment variables.

```yaml
uses: aws-actions/configure-aws-credentials@v6.2.3
with:
  aws-region: us-east-2
  role-to-assume: my-github-actions-role
  http-proxy: "http://companydomain.com:3128"
```

```bash
# Your environment configuration
HTTP_PROXY="http://companydomain.com:3128"
```

--------------------------------

### Action Output Parameters

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

Values returned by the action after successful authentication.

```text
aws-account-id: string
authenticated-arn: string
aws-access-key-id: string (if output-credentials set)
aws-secret-access-key: string (if output-credentials set)
aws-session-token: string (if output-credentials set)
aws-expiration: string (if output-credentials set)
```

--------------------------------

### Create IAM OIDC Provider via AWS CLI

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Command to register GitHub's OIDC endpoint as an identity provider in AWS.

```bash
aws iam create-open-id-connect-provider \
    --url https://token.actions.githubusercontent.com \
    --client-id-list sts.amazonaws.com
```

--------------------------------

### Implement Fallback Authentication

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Use the outcome of a primary OIDC configuration step to trigger a secondary static credential configuration if the first attempt fails.

```yaml
- name: Configure AWS Credentials (OIDC)
  id: oidc
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-1
    role-to-assume: ${{ secrets.AWS_ROLE }}
  continue-on-error: true

- name: Configure AWS Credentials (Static)
  if: steps.oidc.outcome == 'failure'
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-1
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
```

--------------------------------

### Define AWS Credentials and Config File Formats

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/types.md

INI-style configuration formats for AWS credentials and profile settings.

```ini
[profilename]
aws_access_key_id = AKIA...
aws_secret_access_key = ...
aws_session_token = ...
```

```ini
[profile profilename]
region = us-east-1
```

```ini
[default]
region = us-east-1
```

--------------------------------

### Manage Credentials

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for handling existing credentials and clearing current session state.

```text
unset-current-credentials
use-existing-credentials
```

--------------------------------

### Define Credentials Client and Role Configuration Interfaces

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

TypeScript interfaces for configuring the credentials client, assuming roles, and setting proxy options.

```typescript
interface CredentialsClientProps {
  region?: string
  proxyServer?: string
  noProxy?: string
  stsEndpoint?: string
  roleChaining: boolean
}

interface assumeRoleParams {
  credentialsClient: CredentialsClient
  roleToAssume: string
  roleDuration: number
  roleSessionName: string
  sourceAccountId?: string
  roleExternalId?: string
  roleSkipSessionTagging?: boolean
  transitiveTagKeys?: string[]
  webIdentityTokenFile?: string
  webIdentityToken?: string
  inlineSessionPolicy?: string
  managedSessionPolicies?: { arn: string }[]
  customTags?: string
}

interface ProxyOptions {
  readonly noProxy?: string
  readonly httpsProxy?: string
  readonly httpProxy?: string
}
```

--------------------------------

### File I/O Utilities

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Basic file system operations for reading, writing, and checking file status.

```typescript
export function readFileUtf8(filePath: string): string | null
export function writeFileUtf8(filePath: string, content: string, mode?: number): void
export function mkdir(dir: string, mode?: number): void
export function isSymlink(filePath: string): boolean
```

--------------------------------

### Map environment variables to GitHub Actions input format

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Translates specific environment variables into the INPUT_* format required by GitHub Actions.

```typescript
export function translateEnvVariables(): void
```

--------------------------------

### Configure Role Chaining

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Assume a role through a chain of multiple roles by specifying the profile and chaining flag.

```yaml
with:
  aws-region: us-east-2
  role-to-assume: arn:aws:iam::222222222222:role/second-role
  role-chaining: true
  aws-profile: second-role
env:
  AWS_PROFILE: first-role
```

--------------------------------

### Build custom User-Agent header

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Generates Smithy user agent tokens for SDK calls, including action, run ID, and attempt information.

```typescript
export function buildCustomUserAgent(): UserAgent
```

--------------------------------

### File Permissions Configuration

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Security settings for directories and files, including the use of O_NOFOLLOW on Unix systems.

```text
Directories: 0o700 (rwx------)
Files: 0o600 (rw-------)
Symlink: Refused (except Kubernetes service account token)
O_NOFOLLOW: Used on Unix systems
```

--------------------------------

### Required Configuration Input

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

The mandatory AWS region setting for the action.

```yaml
aws-region: string  # AWS region (e.g., us-east-1)
```

--------------------------------

### Configure Retry and Timeout Behavior

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Parameters for controlling retry logic, timeouts, and character handling.

```text
disable-retry
retry-max-attempts (default: 12)
special-characters-workaround
action-timeout-s
```

--------------------------------

### Configure AWS File Locations

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Environment variables used to override default AWS configuration and credentials file paths.

```bash
AWS_SHARED_CREDENTIALS_FILE  # Overrides ~/.aws/credentials
AWS_CONFIG_FILE              # Overrides ~/.aws/config
```

--------------------------------

### Configure OIDC Authentication

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Use OIDC to assume an IAM role without static credentials.

```yaml
with:
  aws-region: us-east-1
  role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
```

--------------------------------

### Configure Custom Tags via YAML

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Use valid JSON syntax for the custom-tags input, ensuring quotes are handled correctly for complex strings.

```yaml
custom-tags: '{"key": "value"}'
```

```yaml
custom-tags: |
```

--------------------------------

### Define CredentialsClientProps

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/types.md

Configuration properties for initializing the CredentialsClient.

```typescript
interface CredentialsClientProps {
  region?: string;
  proxyServer?: string;
  noProxy?: string;
  stsEndpoint?: string;
  roleChaining: boolean;
}
```

--------------------------------

### Common Error Messages

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

List of error strings that trigger core.setFailed() and cause the action step to fail.

```text
"Region is not valid: {region}"
"Role session name must be between 2 and 64 characters"
"aws-secret-access-key must be provided if aws-access-key-id is provided"
"Credentials could not be loaded"
"Credentials loaded by the SDK do not match the expected access key ID"
"Could not assume role with user credentials: {detail}"
"Could not assume role with OIDC: {detail}"
"The account ID of the provided credentials ({received}) does not match"
"Profile with name "{name}" already exists"
"Web identity token file does not exist: {path}"
"Action timed out after {seconds} seconds"
```

--------------------------------

### writeFileUtf8()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Safely writes a UTF-8 file with secure permissions.

```APIDOC
## writeFileUtf8(filePath: string, content: string, mode?: number)

### Description
Safely writes a UTF-8 file, refusing symlinks and applying secure permissions.

### Parameters
- **filePath** (string) - Required - File path to write
- **content** (string) - Required - File contents
- **mode** (number) - Optional - File permissions (Default: 0o600)
```

--------------------------------

### Module Imports from src/index.ts

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Core imports for the main entry point of the action.

```typescript
import * as core from '@actions/core'
import type { AssumeRoleCommandOutput } from '@aws-sdk/client-sts'
import { assumeRole } from './assumeRole'
import { CredentialsClient } from './CredentialsClient'
import { areCredentialsValid, errorMessage, ... } from './helpers'
import { writeProfileFiles } from './profileManager'
```

--------------------------------

### Configure Multiple Profiles with Role Chaining

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Chain multiple roles by setting the AWS_PROFILE environment variable for subsequent steps.

```yaml
- name: First role
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::111111111111:role/first-role
    aws-profile: first-role

- name: Second role
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::222222222222:role/second-role
    role-chaining: true
    aws-profile: second-role
  env:
    AWS_PROFILE: first-role
```

--------------------------------

### Authentication Configuration Inputs

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

One of these authentication methods is required to establish a session with AWS.

```yaml
role-to-assume: string                    # Role ARN/name to assume
aws-access-key-id: string                 # IAM access key ID
aws-secret-access-key: string             # IAM secret access key
web-identity-token-file: string           # Path to token file
role-chaining: boolean                    # Use existing credentials
OIDC (automatic if role-to-assume + id-token permission)
```

--------------------------------

### Write UTF-8 File Safely

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Writes content to a file with secure permissions, refusing symlinks and truncating existing files.

```typescript
export function writeFileUtf8(
  filePath: string,
  content: string,
  mode?: number,
): void
```

--------------------------------

### Action Output Variables

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Variables produced by the action for use in subsequent steps.

```text
aws-account-id
authenticated-arn
aws-access-key-id (if output-credentials)
aws-secret-access-key (if output-credentials)
aws-session-token (if output-credentials)
aws-expiration (if output-credentials)
```

--------------------------------

### Environment Variables Set by Action

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Environment variables exported by the action into the runner environment.

```text
AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN
AWS_REGION
AWS_DEFAULT_REGION
AWS_PROFILE (if aws-profile configured)
AWS_EXECUTION_ENV = "GitHubActions"
```

--------------------------------

### AWS Config File Format

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

The structure of the ~/.aws/config file for named and default profiles.

```ini
[profile profilename]
region = us-east-1
```

```ini
[default]
region = us-east-1
```

--------------------------------

### readFileUtf8()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Safely reads a UTF-8 file while rejecting symlinks.

```APIDOC
## readFileUtf8(filePath: string)

### Description
Safely reads a UTF-8 file, rejecting symlinks except for specific Kubernetes service account tokens. Uses O_NOFOLLOW to prevent symlink attacks.

### Parameters
- **filePath** (string) - Required - File path to read

### Return Type
string | null
```

--------------------------------

### Configure AWS Credentials with Role Chaining

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Use role-chaining when assuming roles with static credentials or when chaining multiple roles together.

```yaml
- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-role
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-profile: MyProfile1
    role-chaining: true
  env:
    AWS_PROFILE: MyProfile1
```

```yaml
- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-first-role
    aws-profile: firstRoleInChain

- name: assume second role
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
    role-chaining: true
    aws-profile: secondRoleInChain
  env:
    AWS_PROFILE: firstRoleInChain
```

--------------------------------

### Module Imports from src/helpers.ts

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Utility imports for file system operations and STS identity verification.

```typescript
import * as fs from 'node:fs'
import * as path from 'node:path'
import type { Credentials, STSClient } from '@aws-sdk/client-sts'
import { GetCallerIdentityCommand } from '@aws-sdk/client-sts'
import type { AwsCredentialIdentity } from '@aws-sdk/types'
```

--------------------------------

### Configure custom session tags

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Provide custom tags as a JSON object string to the custom-tags input. Ensure the input is a valid JSON object and adheres to character and length constraints.

```yaml
custom-tags: '{"Environment": "Production", "Team": "Platform"}'
```

--------------------------------

### Configure Workflow Environment Variables

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Set global environment variables to control action behavior like cleanup steps or debugging.

```yaml
env:
  AWS_SKIP_CLEANUP_STEP: "true"
```

```yaml
env:
  SHOW_STACK_TRACE: "true"
```

```yaml
env:
  AWS_REGION: us-east-1
  ROLE_TO_ASSUME: arn:aws:iam::123456789012:role/github-actions
  ROLE_DURATION_SECONDS: 1800
```

--------------------------------

### Input Parsing Helpers

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Functions for retrieving action inputs and environment variable translation.

```typescript
export function getBooleanInput(
  name: string,
  options?: core.InputOptions & { default?: boolean }
): boolean

export function translateEnvVariables(): void
```

--------------------------------

### Configure Static Credentials

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Authenticate using static AWS access keys stored in GitHub secrets.

```yaml
with:
  aws-region: us-east-1
  aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
  aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
```

--------------------------------

### Configure Retry Logic

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Use the retry-max-attempts parameter to automatically retry the credential configuration step upon failure.

```yaml
- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-1
    role-to-assume: ${{ secrets.AWS_ROLE }}
    role-duration-seconds: 1800
    retry-max-attempts: 15
```

--------------------------------

### Import Dependencies for src/helpers.ts

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Required imports for credential handling, AWS SDK clients, and file system operations.

```typescript
import * as fs from 'node:fs'
import * as path from 'node:path'
import * as core from '@actions/core'
import type { Credentials, STSClient } from '@aws-sdk/client-sts'
import { GetCallerIdentityCommand } from '@aws-sdk/client-sts'
import type { AwsCredentialIdentity } from '@aws-sdk/types'
import type { UserAgent } from '@smithy/types'
import type { CredentialsClient } from './CredentialsClient'
```

--------------------------------

### Configure Profile-Based Authentication

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Use a specific AWS profile and output credentials to the environment.

```yaml
with:
  aws-region: us-east-1
  role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
  aws-profile: github-actions
  output-env-credentials: true
```

--------------------------------

### Execute Conditional Logic on Failure

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/errors.md

Set continue-on-error to true to allow the workflow to proceed even if the configuration step fails, enabling subsequent steps to handle the failure state.

```yaml
- name: Configure AWS Credentials
  id: aws-config
  uses: aws-actions/configure-aws-credentials@v6
  with:
    aws-region: us-east-1
    role-to-assume: ${{ secrets.AWS_ROLE }}
  continue-on-error: true

- name: Check Configuration
  if: steps.aws-config.outcome == 'failure'
  run: echo "AWS configuration failed"
```

--------------------------------

### stsClient (Getter)

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Retrieves the underlying STSClient instance.

```APIDOC
## stsClient

### Description
Lazy-creates and returns the STS client. In role-chaining mode, the client is recreated on each access to ensure fresh credentials are used.

### Return Type
- **STSClient** - The configured STS client instance
```

--------------------------------

### Import ProxyResolver dependencies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Required import for the ProxyResolver class to interact with Node.js HTTP client requests.

```typescript
import type * as http from 'node:http'
```

--------------------------------

### CredentialsClient Dependencies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Required imports for the CredentialsClient module, including AWS SDK clients and proxy handling utilities.

```typescript
import { info } from '@actions/core'
import { STSClient } from '@aws-sdk/client-sts'
import type { AwsCredentialIdentity } from '@aws-sdk/types'
import { NodeHttpHandler } from '@smithy/node-http-handler'
import { ProxyAgent } from 'proxy-agent'
import { buildCustomUserAgent, errorMessage, getCallerIdentity } from './helpers'
import { ProxyResolver } from './ProxyResolver'
```

--------------------------------

### Credential Management Helpers

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Utilities for exporting, validating, and retrieving AWS credentials.

```typescript
export function exportCredentials(
  creds?: Partial<Credentials>,
  outputCredentials?: boolean,
  outputEnvCredentials?: boolean
): void

export function validateAccountId(
  expectedAccountIds: string[] | undefined,
  account: string | undefined
): void

export function toCredentialIdentity(
  creds?: Partial<Credentials>
): AwsCredentialIdentity | undefined

export async function getCallerIdentity(client: STSClient): Promise<{
  Account: string
  Arn: string
  UserId?: string
}>

export async function areCredentialsValid(credentialsClient: CredentialsClient): Promise<boolean>
```

--------------------------------

### AWS Credentials File Format

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

The structure of the ~/.aws/credentials file generated when an aws-profile is specified.

```ini
[profilename]
aws_access_key_id = AKIA...
aws_secret_access_key = ...
aws_session_token = ...  # Only if session token present
```

--------------------------------

### List GitHub Actions Environment Variables

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/types.md

Environment variables read by the action to determine workflow context.

```typescript
GITHUB_REPOSITORY      // "owner/repo"
GITHUB_WORKFLOW       // Workflow name
GITHUB_ACTION         // Action identifier
GITHUB_ACTOR          // Actor triggering workflow
GITHUB_SHA            // Commit SHA
GITHUB_WORKSPACE      // Workspace directory
GITHUB_EVENT_NAME     // Event type (pull_request, push, etc.)
GITHUB_BASE_REF       // Base branch (pull requests)
GITHUB_HEAD_REF       // Head branch (pull requests)
GITHUB_RUN_ID         // Unique run ID
GITHUB_JOB            // Job name
GITHUB_TRIGGERING_ACTOR  // User who triggered workflow
GITHUB_RUN_ATTEMPT    // Attempt number
```

--------------------------------

### configure-aws-credentials

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/INDEX.md

Configures AWS credentials for subsequent steps in a workflow.

```APIDOC
## configure-aws-credentials

### Description
Configures AWS credentials for use in GitHub Actions workflows. It supports multiple authentication methods including IAM access keys, OIDC, and role assumption.

### Required Inputs
- **aws-region** (string) - Required - The AWS region (e.g., us-east-1).

### Authentication Inputs (One required)
- **role-to-assume** (string) - Optional - Role ARN or name to assume.
- **aws-access-key-id** (string) - Optional - IAM access key ID.
- **aws-secret-access-key** (string) - Optional - IAM secret access key.
- **web-identity-token-file** (string) - Optional - Path to the web identity token file.
- **role-chaining** (boolean) - Optional - Use existing credentials.

### Optional Inputs
- **aws-profile** (string) - Optional - Profile name for files.
- **role-duration-seconds** (number) - Optional - Session duration (default: 3600).
- **custom-tags** (JSON string) - Optional - Custom session tags.
- **inline-session-policy** (JSON string) - Optional - Restrict permissions.
- **http-proxy** (string) - Optional - HTTP proxy URL.
- **action-timeout-s** (number) - Optional - Global timeout.

### Outputs
- **aws-account-id** (string) - The AWS account ID.
- **authenticated-arn** (string) - The authenticated ARN.
- **aws-access-key-id** (string) - Access key ID (if output-credentials set).
- **aws-secret-access-key** (string) - Secret access key (if output-credentials set).
- **aws-session-token** (string) - Session token (if output-credentials set).
- **aws-expiration** (string) - Expiration timestamp (if output-credentials set).
```

--------------------------------

### CredentialsClient Class

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Handles credential validation and STS client management.

```typescript
class CredentialsClient {
  constructor(props: CredentialsClientProps)
  public get stsClient(): STSClient
  public async validateCredentials(
    credentials?: AwsCredentialIdentity,
    expectedAccessKeyId?: string,
    roleChaining?: boolean
  ): Promise<{ Account: string; Arn: string; UserId?: string }>
}
```

--------------------------------

### Profile File Management

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Utilities for managing AWS profile files, including INI parsing and path resolution.

```typescript
export function writeProfileFiles(
  profileName: string,
  credentials: Partial<Credentials>,
  region: string,
  overwriteAwsProfile: boolean
): void

export function parseIni(iniData: string): Record<string, Record<string, string>>
export function stringifyIni(data: Record<string, Record<string, string>>): string
export function getProfileFilePaths(): { credentials: string; config: string }
export function validateProfileName(profileName: string): void
```

--------------------------------

### Write AWS profile files

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Writes credentials and configuration to the standard AWS profile locations. Validates the profile name and respects environment variables for file paths.

```typescript
export function writeProfileFiles(
  profileName: string,
  credentials: Partial<Credentials>,
  region: string,
  overwriteAwsProfile: boolean,
): void
```

--------------------------------

### getProfileFilePaths()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Retrieves the file paths for the AWS credentials and config files.

```APIDOC
## getProfileFilePaths()

### Description
Returns the absolute paths to the AWS credentials and config files, respecting environment variables like AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE.

### Return Type
{ credentials: string; config: string }
```

--------------------------------

### Configure inline session policies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Apply inline IAM policies in JSON format to limit credential scope within a workflow.

```yaml
uses: aws-actions/configure-aws-credentials@v6.2.3
with:
  inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
```

```yaml
uses: aws-actions/configure-aws-credentials@v6.2.3
with:
  inline-session-policy: >-
    {
     "Version": "2012-10-17",
     "Statement": [
      {
       "Sid":"Stmt1",
       "Effect":"Allow",
       "Action":"s3:List*",
       "Resource":"*"
      }
     ]
    }
```

--------------------------------

### Text Processing Utilities

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Helpers for sanitizing variables, building user agents, and verifying credential keys.

```typescript
export function sanitizeGitHubVariables(name: string): string
export function buildCustomUserAgent(): UserAgent
export function verifyKeys(creds: Partial<Credentials> | undefined): boolean
```

--------------------------------

### Configure Profile-Based Authentication

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Specify an AWS profile to use for credential resolution.

```yaml
with:
  aws-region: us-east-1
  role-to-assume: arn:aws:iam::123456789012:role/github-actions
  aws-profile: github-actions
```

--------------------------------

### AssumeRole with Role Chaining

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Performs role chaining by assuming a second role using the credentials obtained from a previously assumed role. Requires the second role's trust policy to grant sts:AssumeRole and sts:TagSession to the first role.

```yaml
- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    role-session-name: MySessionName
- name: Configure other AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
    role-session-name: MySessionName
    role-chaining: true
```

--------------------------------

### Execute cleanup module

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Executes the cleanup function when the module is run directly as the main script.

```typescript
if (require.main === module) {
  try {
    cleanup()
  } catch (error) {
    core.setFailed(errorMessage(error))
  }
}
```

--------------------------------

### Configure Transitive Tag Keys

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Use the transitive-tag-keys input to specify which session tags should be forwarded to subsequent roles in a chain.

```yaml
uses: aws-actions/configure-aws-credentials@v6
with:
  transitive-tag-keys: |
    Repository
    Workflow
    Action
    Actor
```

--------------------------------

### ProxyResolver Class

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/quick-reference.md

Resolves proxy configurations for HTTP requests.

```typescript
class ProxyResolver {
  constructor(options: ProxyOptions)
  public readonly getProxyForUrl = (url: string, _req: http.ClientRequest): string
}
```

--------------------------------

### Retrieve Proxy URL

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Returns the appropriate proxy URL for a given target URL, returning an empty string if no proxy is applicable.

```typescript
public readonly getProxyForUrl = (url: string, _req: http.ClientRequest): string
```

--------------------------------

### Module Dependencies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/modules.md

Required imports for the assumeRole module, including AWS SDK clients and internal helper utilities.

```typescript
import assert from 'node:assert'
import path from 'node:path'
import * as core from '@actions/core'
import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts'
import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts'
import type { CredentialsClient } from './CredentialsClient'
import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers'
```

--------------------------------

### retryAndBackoff()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Retries a promise-returning function with exponential backoff.

```APIDOC
## retryAndBackoff<T>(fn, isRetryable, maxRetries?, retries?, base?, label?)

### Description
Retries a promise-returning function with exponential backoff. If the function fails and is retryable, it waits for a calculated duration before retrying.

### Parameters
- **fn** (() => Promise<T>) - Required - Function to retry
- **isRetryable** (boolean) - Required - Enable retries if true
- **maxRetries** (number) - Optional - Max retry attempts (Default: 12)
- **retries** (number) - Optional - Current retry count
- **base** (number) - Optional - Base delay in ms (Default: 50)
- **label** (string) - Optional - Label for logging

### Return Type
Promise<T>
```

--------------------------------

### Exported Credential Environment Variables

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/configuration.md

Environment variables set by the action when output-env-credentials is enabled.

```bash
AWS_ACCESS_KEY_ID          # Access key ID
AWS_SECRET_ACCESS_KEY      # Secret access key
AWS_SESSION_TOKEN          # Session token (cleared if not present)
AWS_REGION                 # AWS region
AWS_DEFAULT_REGION         # AWS region (same as AWS_REGION)
AWS_PROFILE                # Profile name (if aws-profile input set)
```

--------------------------------

### Configure managed session policies

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/README.md

Apply existing IAM managed policies by ARN to limit credential scope.

```yaml
uses: aws-actions/configure-aws-credentials@v6.2.3
with:
  managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
```

```yaml
uses: aws-actions/configure-aws-credentials@v6.2.3
with:
  managed-session-policies: |
    arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
    arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess
```

--------------------------------

### getBooleanInput()

Source: https://github.com/aws-actions/configure-aws-credentials/blob/main/_autodocs/api-reference.md

Parses boolean input from GitHub Actions action.yml.

```APIDOC
## getBooleanInput(name: string, options?)

### Description
Parses boolean input from GitHub Actions action.yml using YAML 1.2 spec. Recognizes various true/false string variations.

### Parameters
- **name** (string) - Required - Input name
- **options** (InputOptions) - Optional - {required?, default?}

### Return Type
boolean
```