mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-03-26 18:23:04 -04:00
c84cbd56a1
Add support for OIDC workload identity federation.
Add ID_TOKEN_SIGNING_ALGORITHM, ID_TOKEN_SIGNING_PRIVATE_KEY_FILE, and
ID_TOKEN_EXPIRATION_TIME settings to settings.actions to allow for admin
configuration of this functionality.
Add OIDC endpoints (/.well-known/openid-configuration and /.well-known/keys)
underneath the "/api/actions" route.
Add a token generation endpoint (/_apis/pipelines/workflows/{run_id}/idtoken)
underneath the "/api/actions" route.
Depends on: https://code.forgejo.org/forgejo/runner/pulls/1232
Docs PR: https://codeberg.org/forgejo/docs/pulls/1667
Signed-off-by: Mario Minardi <mminardi@shaw.ca>
## Checklist
The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).
### Tests
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10481
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Mario Minardi <mminardi@shaw.ca>
Co-committed-by: Mario Minardi <mminardi@shaw.ca>
99 lines
3.3 KiB
Go
99 lines
3.3 KiB
Go
package actions
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
actions_model "forgejo.org/models/actions"
|
|
"forgejo.org/models/repo"
|
|
"forgejo.org/models/user"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGenerateTaskContext(t *testing.T) {
|
|
workflowFormat := `
|
|
name: Pull Request
|
|
on: pull_request
|
|
enable-openid-connect: %s
|
|
jobs:
|
|
wf1-job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo 'test the pull'
|
|
`
|
|
testUser := &user.User{
|
|
ID: 1,
|
|
Name: "testuser",
|
|
}
|
|
|
|
testRepo := &repo.Repository{
|
|
ID: 1,
|
|
OwnerName: "testowner",
|
|
Name: "testrepo",
|
|
}
|
|
|
|
createTask := func(workflowPayload string, isFork bool, triggerEvent string) *actions_model.ActionTask {
|
|
return &actions_model.ActionTask{
|
|
ID: 47,
|
|
Job: &actions_model.ActionRunJob{
|
|
ID: 2,
|
|
RunID: 1,
|
|
Run: &actions_model.ActionRun{
|
|
ID: 1,
|
|
Index: 42,
|
|
TriggerUser: testUser,
|
|
Repo: testRepo,
|
|
TriggerEvent: triggerEvent,
|
|
Ref: "refs/heads/main",
|
|
CommitSHA: "abc123def456",
|
|
WorkflowID: "test-workflow.yaml",
|
|
WorkflowDirectory: ".forgejo/workflows",
|
|
EventPayload: `{"repository": {"name": "testrepo"}}`,
|
|
IsForkPullRequest: isFork,
|
|
},
|
|
WorkflowPayload: []byte(workflowPayload),
|
|
},
|
|
}
|
|
}
|
|
|
|
t.Run("openid connect enabled", func(t *testing.T) {
|
|
task := createTask(fmt.Sprintf(workflowFormat, "true"), false, "push")
|
|
|
|
taskContext, err := generateTaskContext(task)
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["gitea_runtime_token"].GetStringValue())
|
|
})
|
|
|
|
t.Run("openid connect enabled from fork with pull_request_target event", func(t *testing.T) {
|
|
task := createTask(fmt.Sprintf(workflowFormat, "true"), true, "pull_request_target")
|
|
|
|
taskContext, err := generateTaskContext(task)
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["gitea_runtime_token"].GetStringValue())
|
|
})
|
|
|
|
t.Run("openid connect enabled from fork with pull_request event", func(t *testing.T) {
|
|
task := createTask(fmt.Sprintf(workflowFormat, "true"), true, "pull_request")
|
|
|
|
taskContext, err := generateTaskContext(task)
|
|
require.NoError(t, err)
|
|
require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
|
|
require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["gitea_runtime_token"].GetStringValue())
|
|
})
|
|
|
|
t.Run("openid connect disabled", func(t *testing.T) {
|
|
task := createTask(fmt.Sprintf(workflowFormat, "false"), false, "push")
|
|
|
|
taskContext, err := generateTaskContext(task)
|
|
require.NoError(t, err)
|
|
require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
|
|
require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
|
|
require.NotEmpty(t, taskContext.Fields["gitea_runtime_token"].GetStringValue())
|
|
})
|
|
}
|