mirror of
https://github.com/versity/versitygw.git
synced 2026-09-23 16:34:18 +00:00
dependabot[bot]andGitHub
77aa23b491
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
name: IAM functional tests (GitHub OIDC live)
|
|
|
|
# This workflow exercises AssumeRoleWithWebIdentity against a REAL external
|
|
# OIDC identity provider (GitHub Actions' own OIDC issuer) - the one publicly
|
|
# reachable, free IdP available from inside our own CI job, so no self-hosted
|
|
# IdP container is needed.
|
|
#
|
|
# Trigger stays plain `pull_request` (never pull_request_target or
|
|
# workflow_run) plus `push` to main. On a pull_request run, GitHub itself
|
|
# downgrades GITHUB_TOKEN/OIDC permissions to read-only whenever the PR
|
|
# comes from a fork - regardless of what this file requests - so
|
|
# ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN simply won't
|
|
# exist in that case and the test below skips itself. That's the actual
|
|
# security boundary here: a hostile fork-PR author cannot use their own PR
|
|
# to mint a token scoped to this repo's identity through this workflow. Only
|
|
# a same-repo (non-fork) pull_request run, or a push to main, gets real
|
|
# credentials and actually exercises the live OIDC flow.
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
name: RunIAMGitHubOIDCTest
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v7
|
|
with:
|
|
go-version: "stable"
|
|
id: go
|
|
|
|
- name: Get Dependencies
|
|
run: |
|
|
go mod download
|
|
|
|
- name: Build
|
|
run: |
|
|
make testbin
|
|
|
|
- name: Run GitHub OIDC live web-identity and s3 session tests
|
|
run: |
|
|
./runoidctests.sh
|