mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-05-12 22:10:25 +00:00
Add support for OIDC workload identity federation.
Add ID_TOKEN_SIGNING_ALGORITHM, ID_TOKEN_SIGNING_PRIVATE_KEY_FILE, and
ID_TOKEN_EXPIRATION_TIME settings to settings.actions to allow for admin
configuration of this functionality.
Add OIDC endpoints (/.well-known/openid-configuration and /.well-known/keys)
underneath the "/api/actions" route.
Add a token generation endpoint (/_apis/pipelines/workflows/{run_id}/idtoken)
underneath the "/api/actions" route.
Depends on: https://code.forgejo.org/forgejo/runner/pulls/1232
Docs PR: https://codeberg.org/forgejo/docs/pulls/1667
Signed-off-by: Mario Minardi <mminardi@shaw.ca>
## Checklist
The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).
### Tests
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10481
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Mario Minardi <mminardi@shaw.ca>
Co-committed-by: Mario Minardi <mminardi@shaw.ca>
218 lines
5.9 KiB
Go
218 lines
5.9 KiB
Go
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package setting
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"forgejo.org/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func Test_getStorageInheritNameSectionTypeForActions(t *testing.T) {
|
|
iniStr := `
|
|
[storage]
|
|
STORAGE_TYPE = minio
|
|
`
|
|
cfg, err := NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "minio", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log/", Actions.LogStorage.MinioConfig.BasePath)
|
|
assert.EqualValues(t, "minio", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts/", Actions.ArtifactStorage.MinioConfig.BasePath)
|
|
|
|
iniStr = `
|
|
[storage.actions_log]
|
|
STORAGE_TYPE = minio
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "minio", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log/", Actions.LogStorage.MinioConfig.BasePath)
|
|
assert.EqualValues(t, "local", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts", filepath.Base(Actions.ArtifactStorage.Path))
|
|
|
|
iniStr = `
|
|
[storage.actions_log]
|
|
STORAGE_TYPE = my_storage
|
|
|
|
[storage.my_storage]
|
|
STORAGE_TYPE = minio
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "minio", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log/", Actions.LogStorage.MinioConfig.BasePath)
|
|
assert.EqualValues(t, "local", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts", filepath.Base(Actions.ArtifactStorage.Path))
|
|
|
|
iniStr = `
|
|
[storage.actions_artifacts]
|
|
STORAGE_TYPE = my_storage
|
|
|
|
[storage.my_storage]
|
|
STORAGE_TYPE = minio
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "local", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log", filepath.Base(Actions.LogStorage.Path))
|
|
assert.EqualValues(t, "minio", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts/", Actions.ArtifactStorage.MinioConfig.BasePath)
|
|
|
|
iniStr = `
|
|
[storage.actions_artifacts]
|
|
STORAGE_TYPE = my_storage
|
|
|
|
[storage.my_storage]
|
|
STORAGE_TYPE = minio
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "local", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log", filepath.Base(Actions.LogStorage.Path))
|
|
assert.EqualValues(t, "minio", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts/", Actions.ArtifactStorage.MinioConfig.BasePath)
|
|
|
|
iniStr = ``
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "local", Actions.LogStorage.Type)
|
|
assert.Equal(t, "actions_log", filepath.Base(Actions.LogStorage.Path))
|
|
assert.EqualValues(t, "local", Actions.ArtifactStorage.Type)
|
|
assert.Equal(t, "actions_artifacts", filepath.Base(Actions.ArtifactStorage.Path))
|
|
}
|
|
|
|
func Test_getDefaultActionsURLForActions(t *testing.T) {
|
|
oldActions := Actions
|
|
oldAppURL := AppURL
|
|
defer func() {
|
|
Actions = oldActions
|
|
AppURL = oldAppURL
|
|
}()
|
|
|
|
AppURL = "http://test_get_default_actions_url_for_actions:3000/"
|
|
|
|
tests := []struct {
|
|
name string
|
|
iniStr string
|
|
wantURL string
|
|
}{
|
|
{
|
|
name: "default",
|
|
iniStr: `
|
|
[actions]
|
|
`,
|
|
wantURL: "https://data.forgejo.org",
|
|
},
|
|
{
|
|
name: "github",
|
|
iniStr: `
|
|
[actions]
|
|
DEFAULT_ACTIONS_URL = github
|
|
`,
|
|
wantURL: "https://github.com",
|
|
},
|
|
{
|
|
name: "self",
|
|
iniStr: `
|
|
[actions]
|
|
DEFAULT_ACTIONS_URL = self
|
|
`,
|
|
wantURL: "http://test_get_default_actions_url_for_actions:3000",
|
|
},
|
|
{
|
|
name: "custom urls",
|
|
iniStr: `
|
|
[actions]
|
|
DEFAULT_ACTIONS_URL = https://example.com
|
|
`,
|
|
wantURL: "https://example.com",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
cfg, err := NewConfigProviderFromData(tt.iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.Equal(t, tt.wantURL, Actions.DefaultActionsURL.URL())
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_getIDTokenSettingsForActions(t *testing.T) {
|
|
defer test.MockVariableValue(&AppDataPath, "/home/app/data")()
|
|
|
|
oldActions := Actions
|
|
oldAppURL := AppURL
|
|
defer func() {
|
|
Actions = oldActions
|
|
AppURL = oldAppURL
|
|
}()
|
|
|
|
iniStr := `
|
|
[actions]
|
|
`
|
|
cfg, err := NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "RS256", Actions.IDTokenSigningAlgorithm)
|
|
assert.Equal(t, "/home/app/data/actions_id_token/private.pem", Actions.IDTokenSigningPrivateKeyFile)
|
|
assert.EqualValues(t, 3600, Actions.IDTokenExpirationTime)
|
|
|
|
iniStr = `
|
|
[actions]
|
|
ID_TOKEN_SIGNING_ALGORITHM = ES256
|
|
ID_TOKEN_SIGNING_PRIVATE_KEY_FILE = /test/test.pem
|
|
ID_TOKEN_EXPIRATION_TIME = 120
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "ES256", Actions.IDTokenSigningAlgorithm)
|
|
assert.Equal(t, "/test/test.pem", Actions.IDTokenSigningPrivateKeyFile)
|
|
assert.EqualValues(t, 120, Actions.IDTokenExpirationTime)
|
|
|
|
iniStr = `
|
|
[actions]
|
|
ID_TOKEN_SIGNING_ALGORITHM = EdDSA
|
|
ID_TOKEN_SIGNING_PRIVATE_KEY_FILE = ./test/test.pem
|
|
ID_TOKEN_EXPIRATION_TIME = 123
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
require.NoError(t, loadActionsFrom(cfg))
|
|
|
|
assert.EqualValues(t, "EdDSA", Actions.IDTokenSigningAlgorithm)
|
|
assert.Equal(t, "/home/app/data/test/test.pem", Actions.IDTokenSigningPrivateKeyFile)
|
|
assert.EqualValues(t, 123, Actions.IDTokenExpirationTime)
|
|
|
|
iniStr = `
|
|
[actions]
|
|
ID_TOKEN_SIGNING_ALGORITHM = HS256
|
|
`
|
|
cfg, err = NewConfigProviderFromData(iniStr)
|
|
require.NoError(t, err)
|
|
err = loadActionsFrom(cfg)
|
|
require.Errorf(t, err, "invalid [actions] ID_TOKEN_SIGNING_ALGORITHM %q", Actions.IDTokenSigningAlgorithm)
|
|
}
|