mirror of
https://github.com/versity/versitygw.git
synced 2026-08-17 20:56:21 +00:00
niksis02
eeff64c255
Add IAMAssumeRoleWithWebIdentity_github_oidc_live, the only web-identity test that exercises AssumeRoleWithWebIdentity against a real external OIDC provider end-to-end: GitHub Actions' own issuer, with real discovery-document fetch, JWKS fetch, RS256 signature verification, claims mapping, and session credential issuance. Every other web-identity test in the suite uses a fake token that never reaches real signature verification. The test registers a throwaway OIDC provider and trust role scoped to this repo (via a distinct test audience and repo-scoped sub condition), fetches a real ID token from GitHub's runtime endpoint, assumes the role, and confirms the issued session credentials work with a follow-up GetCallerIdentity call. It cleans up the role and provider unconditionally and skips itself when run outside a GitHub Actions job with id-token: write permission (e.g. local runs or fork PRs, where GitHub downgrades OIDC permissions to read-only). Add functional-iam-oidc.yml to run this test in CI on push to main and on same-repo pull_request runs, isolated from the full iam suite since it's the only test needing id-token: write. Add a SKIP counter and skipF() alongside the existing runF/passF/failF, and report it in the final RAN/PASS/FAIL summary, so a test opting out via skipF() (as this one does when OIDC env vars aren't present) is visible instead of silently absent from the count.
56 lines
1.4 KiB
Go
56 lines
1.4 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"sync/atomic"
|
|
)
|
|
|
|
var (
|
|
colorReset = "\033[0m"
|
|
colorRed = "\033[31m"
|
|
colorGreen = "\033[32m"
|
|
colorCyan = "\033[36m"
|
|
colorYellow = "\033[33m"
|
|
)
|
|
|
|
var (
|
|
RunCount atomic.Uint32
|
|
PassCount atomic.Uint32
|
|
FailCount atomic.Uint32
|
|
SkipCount atomic.Uint32
|
|
)
|
|
|
|
func runF(format string, a ...any) {
|
|
RunCount.Add(1)
|
|
fmt.Printf(colorCyan+"RUN "+colorReset+format+"\n", a...)
|
|
}
|
|
|
|
func failF(format string, a ...any) {
|
|
FailCount.Add(1)
|
|
fmt.Printf(colorRed+"FAIL "+colorReset+format+"\n", a...)
|
|
}
|
|
|
|
func passF(format string, a ...any) {
|
|
PassCount.Add(1)
|
|
fmt.Printf(colorGreen+"PASS "+colorReset+format+"\n", a...)
|
|
}
|
|
|
|
func skipF(format string, a ...any) {
|
|
SkipCount.Add(1)
|
|
fmt.Printf(colorYellow+"SKIP "+colorReset+format+"\n", a...)
|
|
}
|