mirrors/forgejo

Fork 0

mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-09-18 08:45:55 +00:00

Commit graph

Author SHA1 Message Date

Author	SHA1	Message	Date
ChristopherHX	b058fb4012	Add ac claim for old docker/build-push-action@v3 / current buildx gha cache (#29584 ) Also resolves a warning for current releases ``` \| ##[group]GitHub Actions runtime token ACs \| ##[warning]Cannot parse GitHub Actions Runtime Token ACs: "undefined" is not valid JSON \| ##[endgroup] ====> \| ##[group]GitHub Actions runtime token ACs \| ##[endgroup] ``` \* this is an error in v3 References in the docker org: - `831ca179d3/src/main.ts (L24)` - `7d8b4dc669/src/github.ts (L61)` No known official action of GitHub makes use of this claim. Current releases throw an error when configure to use actions cache ``` \| ERROR: failed to solve: failed to configure gha cache exporter: invalid token without access controls \| ##[error]buildx failed with: ERROR: failed to solve: failed to configure gha cache exporter: invalid token without access controls ``` (cherry picked from commit 368743baf3d904f86b553a88718583906f571c87)	2024-03-11 23:36:58 +07:00
wxiaoguang	62d3e5255f	Port "Use general token signing secret" Port of https://github.com/go-gitea/gitea/pull/29205 Use a clearly defined "signing secret" for token signing. (cherry picked from commit 8be198cdef0a486f417663b1fd6878458d7e5d92)	2024-02-19 20:49:37 +01:00
ChristopherHX	a9bc590d5d	Add artifacts v4 jwt to job message and accept it (#28885 ) This change allows act_runner / actions_runner to use jwt tokens for `ACTIONS_RUNTIME_TOKEN` that are compatible with actions/upload-artifact@v4. The official Artifact actions are now validating and extracting the jwt claim scp to get the runid and jobid, the old artifact backend also needs to accept the same token jwt. --- Related to #28853 I'm not familar with the auth system, maybe you know how to improve this I have tested - the jwt token is a valid token for artifact uploading - the jwt token can be parsed by actions/upload-artifact@v4 and passes their scp claim validation Next steps would be a new artifacts@v4 backend. ~~I'm linking the act_runner change soonish.~~ act_runner change to make the change effective and use jwt tokens <https://gitea.com/gitea/act_runner/pulls/471>	2024-02-02 14:25:59 +00:00

ChristopherHX

b058fb4012

Add ac claim for old docker/build-push-action@v3 / current buildx gha cache (#29584 )

Also resolves a warning for current releases

```
| ##[group]GitHub Actions runtime token ACs
| ##[warning]Cannot parse GitHub Actions Runtime Token ACs: "undefined" is not valid JSON
| ##[endgroup]
====>
| ##[group]GitHub Actions runtime token ACs
| ##[endgroup]
```
\* this is an error in v3

References in the docker org:
-
831ca179d3/src/main.ts (L24)
-
7d8b4dc669/src/github.ts (L61)

No known official action of GitHub makes use of this claim.

Current releases throw an error when configure to use actions cache
```
| ERROR: failed to solve: failed to configure gha cache exporter: invalid token without access controls
| ##[error]buildx failed with: ERROR: failed to solve: failed to configure gha cache exporter: invalid token without access controls
```

(cherry picked from commit 368743baf3d904f86b553a88718583906f571c87)

2024-03-11 23:36:58 +07:00

wxiaoguang

62d3e5255f

Port "Use general token signing secret"

Port of https://github.com/go-gitea/gitea/pull/29205

Use a clearly defined "signing secret" for token signing.

(cherry picked from commit 8be198cdef0a486f417663b1fd6878458d7e5d92)

2024-02-19 20:49:37 +01:00

ChristopherHX

a9bc590d5d

Add artifacts v4 jwt to job message and accept it (#28885 )

This change allows act_runner / actions_runner to use jwt tokens for
`ACTIONS_RUNTIME_TOKEN` that are compatible with
actions/upload-artifact@v4.

The official Artifact actions are now validating and extracting the jwt
claim scp to get the runid and jobid, the old artifact backend also
needs to accept the same token jwt.

---
Related to #28853

I'm not familar with the auth system, maybe you know how to improve this

I have tested
- the jwt token is a valid token for artifact uploading
- the jwt token can be parsed by actions/upload-artifact@v4 and passes
their scp claim validation

Next steps would be a new artifacts@v4 backend.

~~I'm linking the act_runner change soonish.~~
act_runner change to make the change effective and use jwt tokens
<https://gitea.com/gitea/act_runner/pulls/471>

2024-02-02 14:25:59 +00:00

3 commits