fix(auth): preserve OIDC through reusable workflow expansion #28

Merged

gitchegumi merged 1 commit from kiyi/preserve-reusable-oidc into main

2026-09-07 23:15:43 -05:00

kiyi commented

2026-09-07 22:25:45 -05:00

Member

Source inspection: Forgejo 16.0.3 uses runner jobparser v12.13.2. Reusable expansion serializes a SingleWorkflow, rebuilds the child job, and evaluates its OIDC setting against the reusable workflow-level default. The jobparser Job representation omits the job-level OIDC field, so the existing job-only setting can be lost. A workflow-level default survives this path.

Add regression coverage requiring both levels for credential workflows and document a new protected inspection dispatch as runtime acceptance. No authentication-source setup, static request token, OpenBao policy change, or app deployment is involved.

Validation: all 93 Python tests passed in WSL. This is source analysis plus local configuration coverage, not a live parser/runner acceptance claim. After merge, publish v1.4.2, update the caller pins and start a new inspection run on main. Confirm diagnostic identity claims before continuing OpenBao bootstrap.

Related: #19. This does not complete the broader app automation work.

Actual inspection reports ACTIONS_ID_TOKEN_REQUEST_URL missing despite OIDC being enabled on the caller and reusable deploy job. Add top-level enable-openid-connect: true to the shared deploy workflow while preserving its job-level setting. This applies to all app consumers. Source inspection: Forgejo 16.0.3 uses runner jobparser v12.13.2. Reusable expansion serializes a SingleWorkflow, rebuilds the child job, and evaluates its OIDC setting against the reusable workflow-level default. The jobparser Job representation omits the job-level OIDC field, so the existing job-only setting can be lost. A workflow-level default survives this path. Add regression coverage requiring both levels for credential workflows and document a new protected inspection dispatch as runtime acceptance. No authentication-source setup, static request token, OpenBao policy change, or app deployment is involved. Validation: all 93 Python tests passed in WSL. This is source analysis plus local configuration coverage, not a live parser/runner acceptance claim. After merge, publish v1.4.2, update the caller pins and start a new inspection run on main. Confirm diagnostic identity claims before continuing OpenBao bootstrap. Related: #19. This does not complete the broader app automation work.

kiyi added 1 commit

2026-09-07 22:25:45 -05:00

fix(auth): preserve OIDC through reusable workflow expansion

Workflow acceptance / acceptance (pull_request) Successful in 48s

Details

Repository security / security-1 (pull_request) Successful in 1m21s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m51s

Details

c43d27b3b9

Enable OIDC at workflow level as well as job level so reusable expansion preserves the enabled default. Add configuration regression coverage and runtime acceptance instructions.

portegumi approved these changes

2026-09-07 23:14:49 -05:00

portegumi left a comment

Approved at c43d27b3b9. No blocking findings.

The change is narrowly scoped: the shared deployment workflow gains a workflow-level OIDC default while retaining its existing job-level flag. Independently inspected upstream runner v12.13.2 act/jobparser/model.go: SingleWorkflow serializes EnableOpenIDConnect, whereas Job has no corresponding field and SetJob reconstructs RawJobs by marshaling Job. That supports the documented serialization-loss diagnosis and this workaround. Existing protected-dispatch checks, credential handling and inspection-only behavior are unchanged.

Validation: 93 Python tests and all 16 scaffold cases passed. Independently removed the new top-level flag; the new regression failed for the intended missing workflow-level OIDC setting. Restored source and all 16 focused credential tests passed, with a clean checkout and git diff --check. All 4 exact-head hosted status contexts are green. Inspected fresh security decision artifact(s) [197]: passed=true, zero blockers/errors.

This is source/configuration verification, not live parser/runner acceptance. Publish the reviewed patch release, update caller pins together, and start a new protected inspection dispatch to establish that the runner receives OIDC variables and prints diagnostic claims. No static request-token workaround or authentication-source setup is needed by this change. No release, caller update, workflow dispatch, token issuance, merge or deployment was performed in this review.

Approved at c43d27b3b94e7e09eb7ae9ac0aabfc7642955b93. No blocking findings. The change is narrowly scoped: the shared deployment workflow gains a workflow-level OIDC default while retaining its existing job-level flag. Independently inspected upstream runner v12.13.2 act/jobparser/model.go: SingleWorkflow serializes EnableOpenIDConnect, whereas Job has no corresponding field and SetJob reconstructs RawJobs by marshaling Job. That supports the documented serialization-loss diagnosis and this workaround. Existing protected-dispatch checks, credential handling and inspection-only behavior are unchanged. Validation: 93 Python tests and all 16 scaffold cases passed. Independently removed the new top-level flag; the new regression failed for the intended missing workflow-level OIDC setting. Restored source and all 16 focused credential tests passed, with a clean checkout and git diff --check. All 4 exact-head hosted status contexts are green. Inspected fresh security decision artifact(s) [197]: passed=true, zero blockers/errors. This is source/configuration verification, not live parser/runner acceptance. Publish the reviewed patch release, update caller pins together, and start a new protected inspection dispatch to establish that the runner receives OIDC variables and prints diagnostic claims. No static request-token workaround or authentication-source setup is needed by this change. No release, caller update, workflow dispatch, token issuance, merge or deployment was performed in this review.