mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
Max P.
a4908d4af4
Adds OpenID Connect workload identity to Gitea Actions: jobs declaring `id-token: write` can request short-lived tokens to authenticate to cloud providers and other services without stored secrets. Tokens follow GitHub's format, so clients like `@actions/core` and existing trust policies carry over. - Issuer at `/api/actions/oidc` with discovery and JWKS, signed with a dedicated RS256 key - GitHub's claims, including `workflow_ref`, `job_workflow_ref` and the immutable `repo:owner@id/repo@id:ref:...` subject - `id-token: write` or `write-all` grant it, default permissions and fork pull requests never get it, owner and repository maximum permissions can disable it - Reusable workflows record the exact ref they were loaded from, and dispatch rejects refs that only resolve through a same-named tag - Generated signing keys are written atomically, and generated ES384 and ES512 OAuth2 keys use their own curves instead of P-256 - `github.ref_type` is `branch` for pull request runs, like on GitHub Fixes https://github.com/go-gitea/gitea/issues/26383 Fixes https://github.com/go-gitea/gitea/issues/33681 Docs: https://gitea.com/gitea/docs/pulls/526 Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
97 lines
4.4 KiB
Handlebars
97 lines
4.4 KiB
Handlebars
<div class="field">
|
|
<label>{{ctx.Locale.Tr "actions.general.token_permissions.maximum"}}</label>
|
|
|
|
<div class="help">
|
|
{{ctx.Locale.Tr "actions.general.token_permissions.maximum.description"}}
|
|
<br>
|
|
{{ctx.Locale.Tr "actions.general.token_permissions.fork_pr_note"}}
|
|
</div>
|
|
|
|
<div class="field">
|
|
<div class="ui checkbox">
|
|
<input type="checkbox" name="enable_max_permissions" {{if .EnableMaxTokenPermissions}}checked{{end}}>
|
|
<label>{{ctx.Locale.Tr "actions.general.token_permissions.customize_max_permissions"}}</label>
|
|
</div>
|
|
</div>
|
|
|
|
<table class="ui celled table js-permissions-table">
|
|
<thead>
|
|
<tr>
|
|
<th class="tw-w-2/5">{{ctx.Locale.Tr "units.unit"}}</th>
|
|
<th class="tw-text-center">{{ctx.Locale.Tr "org.teams.none_access"}}
|
|
<span class="tw-align-middle" data-tooltip-content="{{ctx.Locale.Tr "org.teams.none_access_helper"}}">{{svg "octicon-question" 16 "tw-ml-1"}}</span>
|
|
</th>
|
|
<th class="tw-text-center">{{ctx.Locale.Tr "org.teams.read_access"}}
|
|
<span class="tw-align-middle" data-tooltip-content="{{ctx.Locale.Tr "org.teams.read_access_helper"}}">{{svg "octicon-question" 16 "tw-ml-1"}}</span>
|
|
</th>
|
|
<th class="tw-text-center">{{ctx.Locale.Tr "org.teams.write_access"}}
|
|
<span class="tw-align-middle" data-tooltip-content="{{ctx.Locale.Tr "org.teams.write_access_helper"}}">{{svg "octicon-question" 16 "tw-ml-1"}}</span>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeCode
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.code")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.code.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeCode)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeIssues
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.issues")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.issues.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeIssues)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypePullRequests
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.pulls")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.pulls.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypePullRequests)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeWiki
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.wiki")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.wiki.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeWiki)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeReleases
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.releases")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.releases.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeReleases)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeProjects
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.projects")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "repo.projects.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeProjects)
|
|
)}}
|
|
{{template "shared/actions/permissions_table_unit" (dict
|
|
"UnitType" ctx.Consts.RepoUnitTypeActions
|
|
"UnitDisplayName" (ctx.Locale.Tr "repo.actions")
|
|
"UnitDisplayDesc" (ctx.Locale.Tr "actions.unit.desc")
|
|
"UnitAccessMode" (index $.MaxTokenPermissions.UnitAccessModes ctx.Consts.RepoUnitTypeActions)
|
|
)}}
|
|
<tr>
|
|
<td>
|
|
<strong>{{ctx.Locale.Tr "actions.general.token_permissions.id_token"}}</strong>
|
|
<div class="help">{{ctx.Locale.Tr "actions.general.token_permissions.id_token.description"}}</div>
|
|
</td>
|
|
<td class="tw-text-center">
|
|
<div class="ui radio checkbox">
|
|
<input type="radio" name="max_id_token" value="none" {{if not $.MaxTokenPermissions.IDToken}}checked{{end}} title="{{ctx.Locale.Tr "org.teams.none_access"}}">
|
|
<label></label>
|
|
</div>
|
|
</td>
|
|
<td></td>
|
|
<td class="tw-text-center">
|
|
<div class="ui radio checkbox">
|
|
<input type="radio" name="max_id_token" value="write" {{if $.MaxTokenPermissions.IDToken}}checked{{end}} title="{{ctx.Locale.Tr "org.teams.write_access"}}">
|
|
<label></label>
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|