CodeArtifact Role Assumption not producing correct workflow

When attempting to use a CodeArtifact NPM registry and assume a role, the generated release workflow still tries to use the Access key ID / Secret access key:

      - name: Release
        run: npx -p publib@latest publib-npm
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: my-domain.d.codeartifact.us-east-2.amazonaws.com/npm/npm/
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

Here is the projen config being used:

import { cdk8s } from "projen";
const project = new cdk8s.ConstructLibraryCdk8s({
  ...
  codeArtifactOptions: {
    roleToAssume: "arn:aws:fake"
  },
  npmRegistryUrl: "https://my-domain.d.codeartifact.us-east-2.amazonaws.com/npm/npm/",

I tried to look in the code to see why this might be happening, but couldn’t immediately identify any problem.

[jessebye]

@Chriscbr would you be able to reopen this issue? #1846 is only a partial fix for this issue.

[AminFazlMondo]

Potential fix for the first issue: https://github.com/projen/projen/pull/1846