enhance(actions): add OIDC workload identity support (#39052)

Adds OpenID Connect workload identity to Gitea Actions: jobs declaring
`id-token: write` can request short-lived tokens to authenticate to
cloud providers and other services without stored secrets. Tokens follow
GitHub's format, so clients like `@actions/core` and existing trust
policies carry over.

- Issuer at `/api/actions/oidc` with discovery and JWKS, signed with a
dedicated RS256 key
- GitHub's claims, including `workflow_ref`, `job_workflow_ref` and the
immutable `repo:owner@id/repo@id:ref:...` subject
- `id-token: write` or `write-all` grant it, default permissions and
fork pull requests never get it, owner and repository maximum
permissions can disable it
- Reusable workflows record the exact ref they were loaded from, and
dispatch rejects refs that only resolve through a same-named tag
- Generated signing keys are written atomically, and generated ES384 and
ES512 OAuth2 keys use their own curves instead of P-256
- `github.ref_type` is `branch` for pull request runs, like on GitHub

Fixes https://github.com/go-gitea/gitea/issues/26383
Fixes https://github.com/go-gitea/gitea/issues/33681
Docs: https://gitea.com/gitea/docs/pulls/526
Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>

tests/integration/actions_job_test.go

@@ -533,7 +533,7 @@ jobs:
 		assert.Equal(t, actionRun.Ref, gtCtx["ref"].GetStringValue())
 		assert.Equal(t, git.RefName(actionRun.Ref).ShortName(), gtCtx["ref_name"].GetStringValue())
 		assert.False(t, gtCtx["ref_protected"].GetBoolValue())
-		assert.Equal(t, string(git.RefName(actionRun.Ref).RefType()), gtCtx["ref_type"].GetStringValue())
+		assert.Equal(t, "branch", gtCtx["ref_type"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.OwnerName+"/"+actionRun.Repo.Name, gtCtx["repository"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.OwnerName, gtCtx["repository_owner"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.HTMLURL(), gtCtx["repositoryUrl"].GetStringValue())
@@ -625,7 +625,7 @@ jobs:
 		assert.Equal(t, actionRun.Ref, gtCtx["ref"].GetStringValue())
 		assert.Equal(t, git.RefName(actionRun.Ref).ShortName(), gtCtx["ref_name"].GetStringValue())
 		assert.False(t, gtCtx["ref_protected"].GetBoolValue())
-		assert.Equal(t, string(git.RefName(actionRun.Ref).RefType()), gtCtx["ref_type"].GetStringValue())
+		assert.Equal(t, "branch", gtCtx["ref_type"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.OwnerName+"/"+actionRun.Repo.Name, gtCtx["repository"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.OwnerName, gtCtx["repository_owner"].GetStringValue())
 		assert.Equal(t, actionRun.Repo.HTMLURL(), gtCtx["repositoryUrl"].GetStringValue())

tests/integration/actions_oidc_test.go

@@ -0,0 +1,105 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"crypto/rsa"
+	"encoding/base64"
+	"fmt"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	actions_service "gitea.dev/services/actions"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionsOIDC(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, _ *url.URL) {
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		token := getTokenForLoggedInUser(t, loginUser(t, user2.Name), auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+		repo := createActionsTestRepo(t, token, "actions-oidc", false)
+		runner := newMockRunner()
+		runner.registerAsRepoRunner(t, user2.Name, repo.Name, "mock-runner", []string{"ubuntu-latest"}, false)
+
+		workflowPath := ".gitea/workflows/oidc.yml"
+		createWorkflowFile(t, token, user2.Name, repo.Name, workflowPath, getWorkflowCreateFileOptions(user2, repo.DefaultBranch, "create "+workflowPath, `name: deploy
+on: push
+jobs:
+  plain:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+  oidc:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - run: echo
+`))
+		tasks := map[string]*runnerv1.Task{}
+		for range 2 {
+			task := runner.fetchTask(t)
+			tasks[task.Context.GetFields()["job"].GetStringValue()] = task
+		}
+		assert.NotContains(t, tasks["plain"].Context.GetFields(), "actions_id_token_request_token")
+		taskContext := tasks["oidc"].Context.GetFields()
+		requestToken := taskContext["actions_id_token_request_token"].GetStringValue()
+		tokenURL, err := url.Parse(taskContext["actions_id_token_request_url"].GetStringValue() + "&audience=sts.example.com")
+		require.NoError(t, err)
+		requestIDToken := func(bearer string, status int) *httptest.ResponseRecorder {
+			return MakeRequest(t, NewRequest(t, "GET", tokenURL.RequestURI()).AddTokenAuth(bearer), status)
+		}
+
+		resp := MakeRequest(t, NewRequest(t, "GET", "/api/actions/oidc/.well-known/openid-configuration"), http.StatusOK)
+		discovery := DecodeJSON(t, resp, &struct {
+			JWKSURI         string   `json:"jwks_uri"`
+			ClaimsSupported []string `json:"claims_supported"`
+		}{})
+		assert.Contains(t, discovery.ClaimsSupported, "job_workflow_ref")
+		jwksURL, err := url.Parse(discovery.JWKSURI)
+		require.NoError(t, err)
+		resp = MakeRequest(t, NewRequest(t, "GET", jwksURL.RequestURI()), http.StatusOK)
+		jwk := DecodeJSON(t, resp, &struct{ Keys []map[string]string }{}).Keys[0]
+		require.Equal(t, "AQAB", jwk["e"])
+		modulus, err := base64.RawURLEncoding.DecodeString(jwk["n"])
+		require.NoError(t, err)
+
+		claims := jwt.MapClaims{}
+		idToken := DecodeJSON(t, requestIDToken(requestToken, http.StatusOK), &struct{ Value string }{}).Value
+		_, err = jwt.ParseWithClaims(idToken, claims, func(*jwt.Token) (any, error) {
+			return &rsa.PublicKey{N: new(big.Int).SetBytes(modulus), E: 65537}, nil
+		}, jwt.WithIssuer(actions_service.OIDCIssuer()), jwt.WithAudience("sts.example.com"))
+		require.NoError(t, err)
+		workflowRef := repo.FullName + "/" + workflowPath + "@refs/heads/" + repo.DefaultBranch
+		assert.Equal(t, fmt.Sprintf("repo:%s@%d/%s@%d:ref:refs/heads/%s", user2.Name, user2.ID, repo.Name, repo.ID, repo.DefaultBranch), claims["sub"])
+		assert.Equal(t, "sts.example.com", claims["aud"])
+		assert.Equal(t, "deploy", claims["workflow"])
+		assert.Equal(t, workflowRef, claims["workflow_ref"])
+		assert.Equal(t, workflowRef, claims["job_workflow_ref"])
+		assert.Equal(t, "public", claims["repository_visibility"])
+
+		requestIDToken(taskContext["gitea_runtime_token"].GetStringValue(), http.StatusUnauthorized)
+		_, job, _ := getTaskAndJobAndRunByTaskID(t, tasks["oidc"].Id)
+		job.TokenPermissions.IDToken = false
+		_, err = actions_model.UpdateRunJob(t.Context(), job, nil, "token_permissions")
+		require.NoError(t, err)
+		requestIDToken(requestToken, http.StatusUnauthorized)
+		job.TokenPermissions.IDToken = true
+		_, err = actions_model.UpdateRunJob(t.Context(), job, nil, "token_permissions")
+		require.NoError(t, err)
+		runner.execTask(t, tasks["oidc"], &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+		requestIDToken(requestToken, http.StatusUnauthorized)
+	})
+}

tests/integration/actions_trigger_test.go

@@ -24,6 +24,7 @@ import (
 	actions_module "gitea.dev/modules/actions"
 	"gitea.dev/modules/commitstatus"
 	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/json"
 	"gitea.dev/modules/setting"
 	api "gitea.dev/modules/structs"
@@ -992,6 +993,13 @@ jobs:
 			CommitSHA:  branch.CommitID,
 		})
 		assert.NotNil(t, run)
+
+		_, _, err = gitcmd.NewCommand("update-ref").AddDynamicArguments("refs/tags/refs/heads/spoof", branch.CommitID).WithRepo(repo).RunStdString(t.Context())
+		require.NoError(t, err)
+		values.Set("ref", "spoof")
+		req = NewRequestWithURLValues(t, "POST", fmt.Sprintf("/api/v1/repos/%s/actions/workflows/dispatch.yml/dispatches", repo.FullName()), values).
+			AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
 	})
 }