mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
Max P.
a4908d4af4
Adds OpenID Connect workload identity to Gitea Actions: jobs declaring `id-token: write` can request short-lived tokens to authenticate to cloud providers and other services without stored secrets. Tokens follow GitHub's format, so clients like `@actions/core` and existing trust policies carry over. - Issuer at `/api/actions/oidc` with discovery and JWKS, signed with a dedicated RS256 key - GitHub's claims, including `workflow_ref`, `job_workflow_ref` and the immutable `repo:owner@id/repo@id:ref:...` subject - `id-token: write` or `write-all` grant it, default permissions and fork pull requests never get it, owner and repository maximum permissions can disable it - Reusable workflows record the exact ref they were loaded from, and dispatch rejects refs that only resolve through a same-named tag - Generated signing keys are written atomically, and generated ES384 and ES512 OAuth2 keys use their own curves instead of P-256 - `github.ref_type` is `branch` for pull request runs, like on GitHub Fixes https://github.com/go-gitea/gitea/issues/26383 Fixes https://github.com/go-gitea/gitea/issues/33681 Docs: https://gitea.com/gitea/docs/pulls/526 Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
30 lines
688 B
Go
30 lines
688 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package actions
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"gitea.dev/modules/web"
|
|
"gitea.dev/routers/api/actions/ping"
|
|
"gitea.dev/routers/api/actions/runner"
|
|
)
|
|
|
|
func Routes(prefix string) *web.Router {
|
|
m := web.NewRouter()
|
|
m.Group("/oidc", func() {
|
|
m.Get("/.well-known/openid-configuration", oidcConfiguration)
|
|
m.Get("/jwks", oidcKeys)
|
|
m.Get("/token", oidcToken)
|
|
})
|
|
|
|
path, handler := ping.NewPingServiceHandler()
|
|
m.Post(path+"*", http.StripPrefix(prefix, handler).ServeHTTP)
|
|
|
|
path, handler = runner.NewRunnerServiceHandler()
|
|
m.Post(path+"*", http.StripPrefix(prefix, handler).ServeHTTP)
|
|
|
|
return m
|
|
}
|