Add support for reusable workflows in trusted publishing #6184
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6184 +/- ##
==========================================
- Coverage 97.24% 94.51% -2.74%
==========================================
Files 476 476
Lines 9788 9875 +87
==========================================
- Hits 9518 9333 -185
- Misses 270 542 +272 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
cseeman
force-pushed
the
feature/reusable-workflow-trusted-publishing
branch
3 times, most recently
from
71eacf0 to
9ca749a
Compare
app/views/components/oidc/trusted_publisher/github_action/form_component.rb
Show resolved
Hide resolved
| same_repo = workflow_repo_owner == repository_owner && workflow_repo_name == repository_name | ||
| base = if same_repo | ||
| base.where(workflow_repository_owner: workflow_repo_owner, workflow_repository_name: workflow_repo_name) | ||
| .or(base.where(workflow_repository_owner: nil, workflow_repository_name: nil)) | ||
| else | ||
| base.where(workflow_repository_owner: workflow_repo_owner, workflow_repository_name: workflow_repo_name) | ||
| end |
There was a problem hiding this comment.
I'm considering that after this is shipped, maybe instead of the columns being optional, we make it required and backfill values to match the org and repo names. That way here, instead of also checking for nil values, we can solely query for the workflow_repo_ownerand workflow_repository_name.
There was a problem hiding this comment.
I think that would be great. All the for_claims stuff would become more simple. Also simpler queries - No .or() clause needed, single path through for_claims, simpler validation, just remove workflow_repository_fields_consistency and workflow_repository_differs_from_repository entirely. And you would have more explicit data, every record clearly states where its workflow lives, no implicit "nil means same repo". I am definitely for that.
cseeman
force-pushed
the
feature/reusable-workflow-trusted-publishing
branch
3 times, most recently
from
9bebbc6 to
f1dd0af
Compare
This change addresses issue rubygems#4294 by adding optional fields to specify a different repository for the workflow source when using GitHub Actions reusable workflows. When a repository calls a reusable workflow from a different repository, the OIDC token's `job_workflow_ref` claim points to the reusable workflow's location, not the caller's workflow. Previously, RubyGems trusted publishing only supported workflows defined in the same repository as the caller. Security: Still validates caller repository against repository_owner/name, preventing unauthorized repositories from publishing via shared workflows Example configuration for a gem using a shared release workflow: - repository_owner: "my-org" (the gem's repo - repository_name: my-gem - workflow_filename: shared-release.yml - workflow_repository_owner: shared-org (the shared workflow's repo) - workflow_repository_name: shared-workflows
cseeman
force-pushed
the
feature/reusable-workflow-trusted-publishing
branch
from
f1dd0af to
ff8e457
Compare
jenshenny
left a comment
jenshenny
left a comment
There was a problem hiding this comment.
This looks good to me. I'll leave this open for a bit so @colby-swandale has a chance to look. When merged, I'll test this on staging to see if everything works as expected before it's shipped to prod.
In the meantime, would you be willing to open a PR to update the trusting publishing guides with the added fields? https://github.com/rubygems/guides
github-project-automation
bot
moved this from Todo
to Ready
in RubyGems.org Pull Requests
2 participants
Hey there RubyGems and @jenshenny 👋 Long time listener, first time caller.
This change addresses issue #4294 by adding optional fields to specify a different repository for the workflow source when using GitHub Actions reusable workflows.
When a repository calls a reusable workflow from a different repository, the OIDC token's
job_workflow_refclaim points to the reusable workflow's location, not the caller's workflow. Previously, RubyGems trusted publishing only supported workflows defined in the same repository as the caller.Security Model Note:
The implementation preserves security by continuing to validate the
repositoryclaim (the caller repository) againstrepository_owner/repository_name. This ensures:Example configuration for a gem using a shared release workflow:
I am starting to use a shared release workflow file with RubyGems Trusted Publishing on the organization gems and it would be amazing to get this working, so I thought I would take a go at adding this feature to RubyGems. Happy address any feedback or requested changes on this, and let me know if anything isn't up to your contributing guide.