mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 08:20:04 +00:00
Max P.
a4908d4af4
Adds OpenID Connect workload identity to Gitea Actions: jobs declaring `id-token: write` can request short-lived tokens to authenticate to cloud providers and other services without stored secrets. Tokens follow GitHub's format, so clients like `@actions/core` and existing trust policies carry over. - Issuer at `/api/actions/oidc` with discovery and JWKS, signed with a dedicated RS256 key - GitHub's claims, including `workflow_ref`, `job_workflow_ref` and the immutable `repo:owner@id/repo@id:ref:...` subject - `id-token: write` or `write-all` grant it, default permissions and fork pull requests never get it, owner and repository maximum permissions can disable it - Reusable workflows record the exact ref they were loaded from, and dispatch rejects refs that only resolve through a same-named tag - Generated signing keys are written atomically, and generated ES384 and ES512 OAuth2 keys use their own curves instead of P-256 - `github.ref_type` is `branch` for pull request runs, like on GitHub Fixes https://github.com/go-gitea/gitea/issues/26383 Fixes https://github.com/go-gitea/gitea/issues/33681 Docs: https://gitea.com/gitea/docs/pulls/526 Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
75 lines
3.0 KiB
Go
75 lines
3.0 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package actions
|
|
|
|
import (
|
|
"context"
|
|
|
|
"gitea.dev/models/perm"
|
|
repo_model "gitea.dev/models/repo"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/json"
|
|
"gitea.dev/modules/util"
|
|
|
|
"xorm.io/xorm/convert"
|
|
)
|
|
|
|
// OwnerActionsConfig defines the Actions configuration for a user or organization
|
|
type OwnerActionsConfig struct {
|
|
// TokenPermissionMode defines the default permission mode (permissive, restricted)
|
|
TokenPermissionMode repo_model.ActionsTokenPermissionMode `json:"token_permission_mode,omitempty"`
|
|
|
|
// MaxTokenPermissions defines the absolute maximum permissions any token can have in this context.
|
|
MaxTokenPermissions *repo_model.ActionsTokenPermissions `json:"max_token_permissions,omitempty"`
|
|
|
|
// AllowedCrossRepoIDs is a list of specific repo IDs that can be accessed cross-repo
|
|
AllowedCrossRepoIDs []int64 `json:"allowed_cross_repo_ids,omitempty"`
|
|
}
|
|
|
|
var _ convert.ConversionFrom = (*OwnerActionsConfig)(nil)
|
|
|
|
func (cfg *OwnerActionsConfig) FromDB(bytes []byte) error {
|
|
_ = json.Unmarshal(bytes, cfg)
|
|
cfg.TokenPermissionMode, _ = util.EnumValue(cfg.TokenPermissionMode)
|
|
return nil
|
|
}
|
|
|
|
// GetOwnerActionsConfig loads the OwnerActionsConfig for a user or organization from user settings
|
|
// It returns a default config if no setting is found
|
|
func GetOwnerActionsConfig(ctx context.Context, userID int64) (ret OwnerActionsConfig, err error) {
|
|
return user_model.GetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, ret)
|
|
}
|
|
|
|
// SetOwnerActionsConfig saves the OwnerActionsConfig for a user or organization to user settings
|
|
func SetOwnerActionsConfig(ctx context.Context, userID int64, cfg OwnerActionsConfig) error {
|
|
return user_model.SetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, cfg)
|
|
}
|
|
|
|
// GetDefaultTokenPermissions returns the default token permissions by its TokenPermissionMode.
|
|
func (cfg *OwnerActionsConfig) GetDefaultTokenPermissions() repo_model.ActionsTokenPermissions {
|
|
switch cfg.TokenPermissionMode {
|
|
case repo_model.ActionsTokenPermissionModeRestricted:
|
|
return repo_model.MakeRestrictedPermissions()
|
|
case repo_model.ActionsTokenPermissionModePermissive:
|
|
return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
|
|
default:
|
|
return repo_model.MakeActionsTokenPermissions(perm.AccessModeNone)
|
|
}
|
|
}
|
|
|
|
// GetMaxTokenPermissions returns the maximum allowed permissions
|
|
func (cfg *OwnerActionsConfig) GetMaxTokenPermissions() repo_model.ActionsTokenPermissions {
|
|
if cfg.MaxTokenPermissions != nil {
|
|
return *cfg.MaxTokenPermissions
|
|
}
|
|
// Default max is write for everything
|
|
return repo_model.MakeWriteAllActionsTokenPermissions()
|
|
}
|
|
|
|
// ClampPermissions ensures that the given permissions don't exceed the maximum
|
|
func (cfg *OwnerActionsConfig) ClampPermissions(perms repo_model.ActionsTokenPermissions) repo_model.ActionsTokenPermissions {
|
|
maxPerms := cfg.GetMaxTokenPermissions()
|
|
return repo_model.ClampActionsTokenPermissions(perms, maxPerms)
|
|
}
|