CI: do not log in to AWS to get manifests

[Pluies]

Description:

Do not log into AWS during CI/CD – it doesn't work with OIDC, and we do not need it. Just retrieve the manifest directly.

[cursor]

PR Summary

Low Risk
Workflow-only change; no application, auth, or data-path logic—only how CI downloads a read-only manifest.

Overview
Removes the Configure AWS Credentials step from the reusable dbt_run workflow so CI no longer assumes an IAM role via OIDC.

The Get latest manifest step now runs aws s3 cp with --no-sign-request, fetching manifest.json from the public (or anonymously readable) S3 path without authenticated AWS credentials.

^{Reviewed by Cursor Bugbot for commit 70f8608. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Anonymous S3 copy lacks region
  • Added --region eu-west-1 to the anonymous aws s3 cp manifest download step so it targets the correct bucket region without credential-based defaults.

Or push these changes by commenting:

@cursor push 6aebaa8814

Preview (6aebaa8814)

diff --git a/.github/workflows/dbt_run.yml b/.github/workflows/dbt_run.yml
--- a/.github/workflows/dbt_run.yml
+++ b/.github/workflows/dbt_run.yml
@@ -49,7 +49,7 @@
           echo "PROJECT_DIR=$PROJECT_DIR" >> $GITHUB_ENV
 
       - name: Get latest manifest
-        run: "aws s3 cp $S3_LOCATION/manifest.json $PROJECT_DIR/manifest.json --no-sign-request"
+        run: "aws s3 cp $S3_LOCATION/manifest.json $PROJECT_DIR/manifest.json --no-sign-request --region eu-west-1"
 
       - name: dbt dependencies
         working-directory: ${{env.PROJECT_DIR}}

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 70f8608. Configure here.}