Ben Kehoe

Maybe adding `base: main`?

Yeah, the action notes that actions which checkout a commit may require `base: main` as input to the create-pull-request action. It's weird because the commit created has no parent

Wait. The default branch on the repo is `create-pull-request/patch`  and `main` is empty 🤔 

this means that the diff of the PR is always against `main` which does not have `.gitmodules`. If the PR is never merged, `.gitmodules` is always new in the commit....

If you're using `--credentials-file-profile`, there's no involvement of expiration, the credentials are always written. `--refresh` is for the `--cache-file` option, which is a separate file, not the `~/.aws/credentials`.

Are you sure that the file isn't being updated? Or perhaps are the credentials being updated, but the expiration field being left alone? [The code only writes the expiration field...

Thanks @benbridts, apparently I overlooked this issue. I should also probably get this into homebrew.

This is interesting. In general I'd say OUs as targets tend to be better than parameterized lists of accounts, but of course that's not always possible. I'm not sure I...

@benbridts do you have any ideas as to how this could be accomplished?

(besides a new `Fn::Map` function, of course)