[bnusunny]

Which issue(s) does this change fix?

No issue. CI failure seen on #9357: run 39695728257.

Why is this change necessary?

The durable-functions lane in build.yml pulls the emulator image from Public ECR without logging in. Public ECR rate-limited the runner, and all 32 tests in the lane failed:

Failed to pull emulator image public.ecr.aws/durable-functions/aws-durable-execution-emulator:latest:
500 Server Error ... ("toomanyrequests: Data limit exceeded")

integration-tests.yml already logs in (tests/setup_testing_resources.py). build.yml does not.

How does it address the issue?

For the durable-functions lane only:

• The job gets id-token: write so it can use OIDC.
• It takes credentials from OIDC_ROLE_ARN with the same pinned configure-aws-credentials action that integration-tests.yml uses, then runs docker login public.ecr.aws.
• The credentials go to step outputs (output-env-credentials: false), so the pytest step never sees them.

What side effects does this change have?

• Fork PRs are unchanged. GitHub gives them no secrets or OIDC token, so the steps are skipped and pulls stay anonymous. The login runs for same-repo PRs and merge_group runs.
• The OIDC role may need a trust-policy update. It is only used by push and schedule runs today. If its trust policy does not allow pull_request and merge_group subjects, the steps fail without failing the job (continue-on-error), and the lane pulls anonymously as it does now.

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods (N/A, workflow only)
• Write design document if needed (N/A)
• Write/update unit tests (N/A, workflow only)
• Write/update integration tests (N/A)
• Write/update functional tests if needed (N/A)
• make pr passes (N/A, no Python changes)
• make update-reproducible-reqs if dependencies were changed (N/A)
• Write documentation (N/A)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[bnusunny]

Superseded by #9364, opened from a branch in this repo so the new Public ECR login steps run in its own CI.