Handle Forgejo reusable workflow events in RKE2 identities #106

Merged

gitchegumi merged 1 commit from kiyi/rke2-oidc-events into main

2026-10-15 18:47:05 -05:00

kiyi commented

2026-10-15 18:34:10 -05:00

Member

Forgejo 16 reports event_name=workflow_call inside reusable jobs started by a manual parent dispatch. RKE2 currently requires workflow_dispatch in inspection, role export and credential issuance, so valid owning jobs stop before onboarding or login. The failure is reproduced with synthetic claims for all three RKE2 components.

Use one claim validator across those paths. Accept the two supported event representations, preserve the observed value, and keep exact issuer, audience, repository/owner, main ref, owning workflow, subject and repository-ID checks. Runtime validation also checks the current run ID. The unchanged protected-dispatch guard independently verifies the manual parent run and approved actor. Generated roles bind one exact observed event; no role is broadened to both values.

Validation: 81 mocked RKE2, delivery/parent-dispatch, credential and Terraform identity tests passed; staged Gitleaks 8.30.1 and diff checks passed. Regressions cover both event representations, wrong events/callers/run IDs, scoped issuance and session revocation. No live API, container build or deployment was used. Existing workflow/job/scan names are unchanged.

After review and merge, include this in one workflow release and promote it to stable-v1. Then start fresh owning RKE2 credential-inspect runs, record the actual selected claims and matching exact event in Terraform, and review the resulting declaration before plan/apply. Local tests do not establish hosted RKE2 acceptance.

Forgejo 16 reports `event_name=workflow_call` inside reusable jobs started by a manual parent dispatch. RKE2 currently requires `workflow_dispatch` in inspection, role export and credential issuance, so valid owning jobs stop before onboarding or login. The failure is reproduced with synthetic claims for all three RKE2 components. Use one claim validator across those paths. Accept the two supported event representations, preserve the observed value, and keep exact issuer, audience, repository/owner, main ref, owning workflow, subject and repository-ID checks. Runtime validation also checks the current run ID. The unchanged protected-dispatch guard independently verifies the manual parent run and approved actor. Generated roles bind one exact observed event; no role is broadened to both values. Validation: 81 mocked RKE2, delivery/parent-dispatch, credential and Terraform identity tests passed; staged Gitleaks 8.30.1 and diff checks passed. Regressions cover both event representations, wrong events/callers/run IDs, scoped issuance and session revocation. No live API, container build or deployment was used. Existing workflow/job/scan names are unchanged. After review and merge, include this in one workflow release and promote it to `stable-v1`. Then start fresh owning RKE2 `credential-inspect` runs, record the actual selected claims and matching exact event in Terraform, and review the resulting declaration before plan/apply. Local tests do not establish hosted RKE2 acceptance.

kiyi added 1 commit

2026-10-15 18:34:10 -05:00

Handle Forgejo reusable workflow events in RKE2 identities

Workflow acceptance / acceptance (pull_request) Successful in 1m38s

Details

Library checks / tests (pull_request) Successful in 4m47s

Details

Repository security / security-1 (pull_request) Successful in 5m11s

Details

a58cbfc538

portegumi reviewed

2026-10-15 18:36:24 -05:00

portegumi left a comment

Source review incomplete: I inspected the full changed claim validator in pipeline/rke2_identity.py and the RKE2 credential regression tests available at this head, but could not inspect the modified call sites in pipeline/rke2_delivery.py or the remainder of the changed tests/docs through the bounded authenticated source reads. The validator retains exact protected owner/repository/ref/workflow/issuer/audience/ID checks, validates run_id when supplied, and binds OpenBao to the single observed event; no UDS routing, package, admission, or manifest file is changed. This is a COMMENT, not an approval or a source-defect finding. All three exact-head checks failed before checkout: Actions jobs 9406 (Library), 9405 (security), and 9404 (acceptance) each report container startup No such image for the pinned job image. These are runner image-start failures, not evidence that the source tests or scans ran or passed. An authorized operator should identify the affected runner host/service, restart that runner if accessible, and rerun the existing checks on this head; then inspect any actual test/security results. Do not merge on this review.

Source review incomplete: I inspected the full changed claim validator in pipeline/rke2_identity.py and the RKE2 credential regression tests available at this head, but could not inspect the modified call sites in pipeline/rke2_delivery.py or the remainder of the changed tests/docs through the bounded authenticated source reads. The validator retains exact protected owner/repository/ref/workflow/issuer/audience/ID checks, validates run_id when supplied, and binds OpenBao to the single observed event; no UDS routing, package, admission, or manifest file is changed. This is a COMMENT, not an approval or a source-defect finding. All three exact-head checks failed before checkout: Actions jobs 9406 (Library), 9405 (security), and 9404 (acceptance) each report container startup `No such image` for the pinned job image. These are runner image-start failures, not evidence that the source tests or scans ran or passed. An authorized operator should identify the affected runner host/service, restart that runner if accessible, and rerun the existing checks on this head; then inspect any actual test/security results. Do not merge on this review.

portegumi approved these changes

2026-10-15 18:36:49 -05:00

portegumi left a comment

Source review at a58cbfc538: inspected the authenticated changed-file inventory and current RKE2 identity, delivery, regression-test and contract documentation paths. The shared claim validator now permits only workflow_dispatch or workflow_call, preserves the signed observed event for an exact single-value OpenBao role, and retains issuer/audience, owning repository/workflow, protected main ref, positive repository IDs, exact subject and runtime run-ID checks. Both credential inspection and issuance call it before OpenBao login; synthetic regressions exercise both representations for all three identities and reject wrong event, workflow, run ID, issuer and audience. The independently enforced protected parent dispatch and scoped UDS bootstrap/controller/Plans boundaries are not relaxed; no gateway/route or ghost bundle is implicated. I found no source-blocking issue in the inspected change. This is SOURCE approval only, not CI/security acceptance. Workflow acceptance run 805 (API 7442), acceptance job 9404, failed before checkout because its runner lacked the pinned job image ('No such image'); this is a runner image startup failure, not a source assertion. The current-head Repository security run 806 and Library checks run 807 also report failure, but their logs/artifacts and causes have NOT been inspected in this bounded review. Investigate those independently, and require clean exact-head hosted checks/security decisions before merge or release. Identify the actual affected runner/service and restart it only through authorized operations if required, then rerun existing checks at this SHA; no empty commit, scan waiver, promotion or deployment is authorized. Pinned UDS admission, platform render and live OpenBao/cluster acceptance remain separate operational gates.

CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review at a58cbfc538a1165779da68c571f06fceb3c859e4: inspected the authenticated changed-file inventory and current RKE2 identity, delivery, regression-test and contract documentation paths. The shared claim validator now permits only workflow_dispatch or workflow_call, preserves the signed observed event for an exact single-value OpenBao role, and retains issuer/audience, owning repository/workflow, protected main ref, positive repository IDs, exact subject and runtime run-ID checks. Both credential inspection and issuance call it before OpenBao login; synthetic regressions exercise both representations for all three identities and reject wrong event, workflow, run ID, issuer and audience. The independently enforced protected parent dispatch and scoped UDS bootstrap/controller/Plans boundaries are not relaxed; no gateway/route or ghost bundle is implicated. I found no source-blocking issue in the inspected change. This is SOURCE approval only, not CI/security acceptance. Workflow acceptance run 805 (API 7442), acceptance job 9404, failed before checkout because its runner lacked the pinned job image ('No such image'); this is a runner image startup failure, not a source assertion. The current-head Repository security run 806 and Library checks run 807 also report failure, but their logs/artifacts and causes have NOT been inspected in this bounded review. Investigate those independently, and require clean exact-head hosted checks/security decisions before merge or release. Identify the actual affected runner/service and restart it only through authorized operations if required, then rerun existing checks at this SHA; no empty commit, scan waiver, promotion or deployment is authorized. Pinned UDS admission, platform render and live OpenBao/cluster acceptance remain separate operational gates. CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request from Homelab/Documentation

2026-10-15 18:37:54 -05:00

Record verified Seaweed Terraform state bootstrap #48