mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-05-13 06:20:24 +00:00
9b88e77c19
Protect OIDC tokens generated by Forgejo Actions from threats arising when users or repositories are renamed or deleted, freeing their names up for reuse by another user. In this threat environment, relying on the name of users and repositories in validating JWT claims is unsafe because they can change. Adds three new claims to Actions' OIDC tokens: - `actor_id` -- the immutable identifier of the actor who triggered an Action run - `repository_id` -- the immutable identifier of the repository on which the Action is running - `repository_owner_id` -- the immutable identifier of the owner of the repository on which the Action is running Repositories will change their subject (`sub`) OIDC claims to include these immutable identifiers. Existing repositories will not change, in order to maintain compatibility with existing JWT usage. The new format will be applied to new repositories, or can be applied by disabling and enabling the Actions unit. The new format embeds the identifiers: - **Existing repos:** `repo:my-org/my-repo:ref:refs/heads/main` - **New repos:** `repo:my-org-123456/my-repo-456789:ref:refs/heads/main` Fixes #12244. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - New fields will be added to documentation soon. - [ ] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12355 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|---|---|---|
| .. | ||
| Test_checkJobsOfRun | ||
| Test_tryHandleIncompleteMatrix | ||
| Test_tryHandleWorkflowCallOuterJob | ||
| TestActions_CancelOrApproveRun | ||
| TestActions_consistencyCheckRun | ||
| TestActionsNotifier_IsTrusted | ||
| TestActionsTrust_GetPullRequestUserIsTrustedWithActions | ||
| TestCancelAbandonedJobs | ||
| TestCancelPreviousJobs | ||
| TestCancelPreviousWithConcurrencyGroup | ||
| TestCreateCommitStatus | ||
| TestExpandLocalReusableWorkflows | ||
| TestGetSecretsOfJob | ||
| TestRerun_RerunAllJobs | ||
| TestRerun_RerunJob | ||
| TestServiceActions_startTask | ||
| TestServicesActions_TransferLingeringLogs | ||
| auth.go | ||
| auth_test.go | ||
| cleanup.go | ||
| cleanup_test.go | ||
| clear_tasks.go | ||
| clear_tasks_test.go | ||
| commit_status.go | ||
| commit_status_test.go | ||
| context.go | ||
| context_test.go | ||
| download.go | ||
| init.go | ||
| interface.go | ||
| job_emitter.go | ||
| job_emitter_test.go | ||
| log.go | ||
| log_test.go | ||
| main_test.go | ||
| notifier.go | ||
| notifier_helper.go | ||
| notifier_helper_test.go | ||
| rerun.go | ||
| rerun_test.go | ||
| reusable_workflows.go | ||
| reusable_workflows_test.go | ||
| run.go | ||
| run_test.go | ||
| schedule_tasks.go | ||
| schedule_tasks_test.go | ||
| secret.go | ||
| secret_test.go | ||
| task.go | ||
| task_test.go | ||
| trust.go | ||
| trust_test.go | ||
| variables.go | ||
| variables_test.go | ||
| workflows.go | ||
| workflows_test.go | ||