OIDC provider #25664

sorenisanerd · 2023-07-04T00:56:24Z

This adds support for a Github Actions compatible OIDC provider.

For more info, see:
https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect

It depends on a few changes in act and act_runner:
https://gitea.com/gitea/act_runner/pulls/272
https://gitea.com/gitea/act/pulls/73

sorenisanerd · 2023-07-04T00:56:49Z

Still work-in-progress. I have a few more things I want to test before it's ready.

lunny · 2023-07-06T03:36:12Z

go.mod

@@ -300,7 +300,7 @@ replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1

 replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0

-replace github.com/nektos/act => gitea.com/gitea/act v0.243.4
+replace github.com/nektos/act => gitea.com/sorenisanerd/act v0.246.1-0.20230704003127-0ffa64475fd8


Please send PR to gitea.com/gitea/act first.

I did. https://gitea.com/gitea/act/pulls/73

sorenisanerd · 2023-07-06T17:46:55Z

I think this is ready for review, but obviously it's useless without the act and act_runner changes.

wolfogre · 2023-07-07T04:30:31Z

@sorenisanerd Thank you for your work, I have to say you did a great job, good idea, good code.

However, this featrue has been blocked some trivial things.

Where to keep the code for parsing permissions? Gitea, the forked act, the upstream act, or using actionlint indead?
The permissions field is only only for OIDC, but the permissions granted to the GITHUB_TOKEN/GITEA_TOKEN (probably more often), personally, I think the latter should be supported first.
Is it possible for contributors to send a PR that updates the permissions field and runs a malicious script?

You know, once permissions are involved, we need to be checked more carefully. Please give us some time to discuss and decide.

sorenisanerd · 2023-07-08T07:55:57Z

Thank you for your kind comments :)

I'm very open to porting this to gitea or actionlinter or wherever. I don't have any strong opinions on it.

I agree it would have made more sense to first use permissions to adjust the capabilities of the GitHub token. I happened to need this oidc-provider functionality, so that's what I focused on. I included methods for merging permissions as well as definitions matching GitHub's defaults so I or someone else could add that later.

Great point about how permissions are affected when permissions apply for pull requests. Is that supposed to be safeguarded by the need to approve workflow runs for new contributors? I honestly don't know what GitHub does.

sorenisanerd · 2023-07-10T04:56:15Z

I've pushed changes to the act and act_runner PR's on gitea.com. The resulting diffs are very modest. The rest of the functionality has been pulled into Gitea here.

Is this approach more agreeable? I'll add some tests once we're happy with the overall approach.

sorenisanerd · 2023-08-10T22:22:38Z

I rebased this and reworked it into a set of more reviewable commits. If you like, I can submit them as individual PR's, but each one depends on the previous ones, which makes it a little awkward to manage as separate PR's.

This depends on a few changes in act and act_runner: https://gitea.com/gitea/act_runner/pulls/272 https://gitea.com/gitea/act/pulls/73

sorenisanerd · 2023-09-16T01:52:26Z

Nothing new, just rebased and folded ded82c3 (the formatting changes based on the linting errors) into the relevant patches.

lunny · 2023-09-16T03:08:14Z

go.mod

@@ -303,7 +303,7 @@ replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1

 replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0

-replace github.com/nektos/act => gitea.com/gitea/act v0.243.4
+replace github.com/nektos/act => gitea.com/sorenisanerd/act v0.246.2-0.20230806181409-a9e947b70bf6


Maybe a update on gitea/act side is better.

As mentioned in the PR description, there's a PR against gitea/act at https://gitea.com/gitea/act/pulls/73 since several months ago.

lunny · 2023-09-16T03:09:51Z

models/migrations/v1_21/v276.go

+
+func AddPermissions(x *xorm.Engine) error {
+	type ActionRunJob struct {
+		Permissions actions_model.Permissions `xorm:"JSON TEXT"`


We need to copy the Permissions struct here because in future that struct maybe changed.

Excellent point. I'll make that change.

Wait, does it even matter, since it's stored as JSON? Should I just put interface{} instead of actions_model.Permissions?

routers/api/v1/oidc.go

lunny · 2023-09-16T03:11:28Z

services/auth/oauth2.go

@@ -103,6 +103,7 @@ func (o *OAuth2) userIDFromToken(ctx context.Context, tokenSHA string, store Dat

 				store.GetData()["IsActionsToken"] = true
 				store.GetData()["ActionsTaskID"] = task.ID
+				store.GetData()["ActionsTask"] = task


We can load the task from database when we need it but not store it in context?

I honestly don't remember why I did it this way. It's been a while. Let me take another look.

Referencing it could cause inconsistencies if it changes later.

sorenisanerd · 2023-09-16T20:11:26Z

I took the liberty of renaming my migration to just permissions.go. At this point, I must have had to rename it 5-7 times locally and it's getting kinda annoying. Once this gets closer to being approved, I'll try to pick a number for it.

sorenisanerd · 2023-09-19T23:38:13Z

I'm also working on a more complete permissions implementation that should probably be merged before this one, so I'm setting this one back to WIP. I expect the permissions patch to be ready some time this week.

punmechanic · 2024-05-08T01:52:11Z

Hello, are there any updates on this? is there something a contributor can help out with? Would love to see this move along

NorNorLukas · 2024-11-05T08:20:23Z

I am also very interested om seeing this moving along. Any updates on this?

scubbo · 2025-03-18T04:05:02Z

Also chiming in support of this - it would be great for Gitea Actions to be able to authenticate to Vault via JWT.

sorenisanerd · 2025-03-19T15:36:16Z

It was taking too much effort to merge/rebase it while it was waiting for review, so I lost my motivation. I can't make promises about when I'll revive it. If someone else wants to take it over, be my guest.

…

On Mon, Mar 17, 2025 at 9:05 PM Jack Jackson ***@***.***> wrote: Also chiming in support of this - it would be great for Gitea Actions to be able to authenticate to Vault via JWT. — Reply to this email directly, view it on GitHub <#25664 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABHCWU2YHQVOXC7UHOW3C32U6LQHAVCNFSM6AAAAABRF6YIUOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOMZRGU2TQNRVG4> . You are receiving this because you were mentioned.Message ID: ***@***.***> [image: scubbo]*scubbo* left a comment (go-gitea/gitea#25664) <#25664 (comment)> Also chiming in support of this - it would be great for Gitea Actions to be able to authenticate to Vault via JWT. — Reply to this email directly, view it on GitHub <#25664 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABHCWU2YHQVOXC7UHOW3C32U6LQHAVCNFSM6AAAAABRF6YIUOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOMZRGU2TQNRVG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

scubbo · 2025-03-20T02:30:14Z

Understandable - thank you for your effort so far!

I haven't made any contributions to the gitea codebase, so I'd mostly just be replicating what you've done and trying my best to understand it as I go - but I'm certainly willing to try!

EDIT: Here's hoping that this will get more traction! I will of course give you full credit if this gets merged. Thanks again, @sorenisanerd!

Resurrecting [this PR](https://gitea.com/gitea/act/pulls/73) as the original author has [lost motivation](go-gitea/gitea#25664 (comment)) (though, to be clear - all credit belongs to them, all mistakes are mine and mine alone!) Co-authored-by: Søren L. Hansen <[email protected]> Reviewed-on: https://gitea.com/gitea/act/pulls/133 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Jack Jackson <[email protected]> Co-committed-by: Jack Jackson <[email protected]>

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jul 4, 2023

pull-request-size bot added the size/L label Jul 4, 2023

lunny reviewed Jul 6, 2023

View reviewed changes

pull-request-size bot added size/XL and removed size/L labels Jul 10, 2023

sorenisanerd force-pushed the oidc-provider branch from 800f861 to 04d2045 Compare July 10, 2023 04:52

sorenisanerd force-pushed the oidc-provider branch from 04d2045 to 0f08ddd Compare July 22, 2023 19:47

jtackaberry mentioned this pull request Aug 7, 2023

Gitea as an OIDC IdP for Actions #26383

Open

sorenisanerd force-pushed the oidc-provider branch 2 times, most recently from 2f188c2 to ded82c3 Compare August 10, 2023 22:20

sorenisanerd changed the title ~~WIP: OIDC provider~~ OIDC provider Aug 10, 2023

sorenisanerd added 4 commits September 15, 2023 18:45

Refactor token signing method in OAuth2 service

3a16680

feat: Add basic permissions support for actions

31e8ad3

This depends on a few changes in act and act_runner: https://gitea.com/gitea/act_runner/pulls/272 https://gitea.com/gitea/act/pulls/73

Extract {base_,}{sha,ref} and EventName logic

8271be5

feat: Add OIDC provider for actions

724e138

sorenisanerd force-pushed the oidc-provider branch from 6f5666e to 724e138 Compare September 16, 2023 01:48

github-actions bot added the modifies/api This PR adds API routes or modifies them label Sep 16, 2023

lunny reviewed Sep 16, 2023

View reviewed changes

routers/api/v1/oidc.go Outdated Show resolved Hide resolved

lunny reviewed Sep 16, 2023

View reviewed changes

sorenisanerd added 2 commits September 16, 2023 13:00

Copy Permissions struct actions_model

fc80a8a

Referencing it could cause inconsistencies if it changes later.

*looks at a calendar*

e192676

Merge remote-tracking branch 'origin/main' into oidc-provider

69ce797

sorenisanerd marked this pull request as draft September 19, 2023 23:38

ChristopherHX mentioned this pull request Feb 25, 2025

Native OIDC Token for workload identity federation #33681

Open

scubbo mentioned this pull request Mar 20, 2025

OIDC provider #33945

Open

techknowlogick removed the size/XL label Apr 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OIDC provider #25664

OIDC provider #25664

sorenisanerd commented Jul 4, 2023

sorenisanerd commented Jul 4, 2023

lunny Jul 6, 2023

sorenisanerd Jul 6, 2023

sorenisanerd commented Jul 6, 2023

wolfogre commented Jul 7, 2023

sorenisanerd commented Jul 8, 2023

sorenisanerd commented Jul 10, 2023

sorenisanerd commented Aug 10, 2023

sorenisanerd commented Sep 16, 2023

lunny Sep 16, 2023

sorenisanerd Sep 16, 2023

lunny Sep 16, 2023

sorenisanerd Sep 16, 2023

sorenisanerd Sep 16, 2023

lunny Sep 16, 2023

sorenisanerd Sep 16, 2023

sorenisanerd commented Sep 16, 2023

sorenisanerd commented Sep 19, 2023

punmechanic commented May 8, 2024

NorNorLukas commented Nov 5, 2024

scubbo commented Mar 18, 2025

sorenisanerd commented Mar 19, 2025 via email

scubbo commented Mar 20, 2025 •

edited

Loading

OIDC provider #25664

Are you sure you want to change the base?

OIDC provider #25664

Conversation

sorenisanerd commented Jul 4, 2023

sorenisanerd commented Jul 4, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sorenisanerd commented Jul 6, 2023

wolfogre commented Jul 7, 2023

sorenisanerd commented Jul 8, 2023

sorenisanerd commented Jul 10, 2023

sorenisanerd commented Aug 10, 2023

sorenisanerd commented Sep 16, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sorenisanerd commented Sep 16, 2023

sorenisanerd commented Sep 19, 2023

punmechanic commented May 8, 2024

NorNorLukas commented Nov 5, 2024

scubbo commented Mar 18, 2025

sorenisanerd commented Mar 19, 2025 via email

scubbo commented Mar 20, 2025 • edited Loading

scubbo commented Mar 20, 2025 •

edited

Loading