-
-
Notifications
You must be signed in to change notification settings - Fork 5.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add artifacts v4 jwt to job message and accept it (#28885)
This change allows act_runner / actions_runner to use jwt tokens for `ACTIONS_RUNTIME_TOKEN` that are compatible with actions/upload-artifact@v4. The official Artifact actions are now validating and extracting the jwt claim scp to get the runid and jobid, the old artifact backend also needs to accept the same token jwt. --- Related to #28853 I'm not familar with the auth system, maybe you know how to improve this I have tested - the jwt token is a valid token for artifact uploading - the jwt token can be parsed by actions/upload-artifact@v4 and passes their scp claim validation Next steps would be a new artifacts@v4 backend. ~~I'm linking the act_runner change soonish.~~ act_runner change to make the change effective and use jwt tokens <https://gitea.com/gitea/act_runner/pulls/471>
- Loading branch information
1 parent
8f9f0e4
commit a9bc590
Showing
4 changed files
with
166 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| // Copyright 2024 The Gitea Authors. All rights reserved. | ||
| // SPDX-License-Identifier: MIT | ||
|
|
||
| package actions | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "net/http" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "code.gitea.io/gitea/modules/log" | ||
| "code.gitea.io/gitea/modules/setting" | ||
|
|
||
| "github.com/golang-jwt/jwt/v5" | ||
| ) | ||
|
|
||
| type actionsClaims struct { | ||
| jwt.RegisteredClaims | ||
| Scp string `json:"scp"` | ||
| TaskID int64 | ||
| RunID int64 | ||
| JobID int64 | ||
| } | ||
|
|
||
| func CreateAuthorizationToken(taskID, runID, jobID int64) (string, error) { | ||
| now := time.Now() | ||
|
|
||
| claims := actionsClaims{ | ||
| RegisteredClaims: jwt.RegisteredClaims{ | ||
| ExpiresAt: jwt.NewNumericDate(now.Add(24 * time.Hour)), | ||
| NotBefore: jwt.NewNumericDate(now), | ||
| }, | ||
| Scp: fmt.Sprintf("Actions.Results:%d:%d", runID, jobID), | ||
| TaskID: taskID, | ||
| RunID: runID, | ||
| JobID: jobID, | ||
| } | ||
| token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) | ||
|
|
||
| tokenString, err := token.SignedString([]byte(setting.SecretKey)) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return tokenString, nil | ||
| } | ||
|
|
||
| func ParseAuthorizationToken(req *http.Request) (int64, error) { | ||
| h := req.Header.Get("Authorization") | ||
| if h == "" { | ||
| return 0, nil | ||
| } | ||
|
|
||
| parts := strings.SplitN(h, " ", 2) | ||
| if len(parts) != 2 { | ||
| log.Error("split token failed: %s", h) | ||
| return 0, fmt.Errorf("split token failed") | ||
| } | ||
|
|
||
| token, err := jwt.ParseWithClaims(parts[1], &actionsClaims{}, func(t *jwt.Token) (any, error) { | ||
| if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok { | ||
| return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"]) | ||
| } | ||
| return []byte(setting.SecretKey), nil | ||
| }) | ||
| if err != nil { | ||
| return 0, err | ||
| } | ||
|
|
||
| c, ok := token.Claims.(*actionsClaims) | ||
| if !token.Valid || !ok { | ||
| return 0, fmt.Errorf("invalid token claim") | ||
| } | ||
|
|
||
| return c.TaskID, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| // Copyright 2024 The Gitea Authors. All rights reserved. | ||
| // SPDX-License-Identifier: MIT | ||
|
|
||
| package actions | ||
|
|
||
| import ( | ||
| "net/http" | ||
| "testing" | ||
|
|
||
| "code.gitea.io/gitea/modules/setting" | ||
|
|
||
| "github.com/golang-jwt/jwt/v5" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestCreateAuthorizationToken(t *testing.T) { | ||
| var taskID int64 = 23 | ||
| token, err := CreateAuthorizationToken(taskID, 1, 2) | ||
| assert.Nil(t, err) | ||
| assert.NotEqual(t, "", token) | ||
| claims := jwt.MapClaims{} | ||
| _, err = jwt.ParseWithClaims(token, claims, func(t *jwt.Token) (interface{}, error) { | ||
| return []byte(setting.SecretKey), nil | ||
| }) | ||
| assert.Nil(t, err) | ||
| scp, ok := claims["scp"] | ||
| assert.True(t, ok, "Has scp claim in jwt token") | ||
| assert.Contains(t, scp, "Actions.Results:1:2") | ||
| taskIDClaim, ok := claims["TaskID"] | ||
| assert.True(t, ok, "Has TaskID claim in jwt token") | ||
| assert.Equal(t, float64(taskID), taskIDClaim, "Supplied taskid must match stored one") | ||
| } | ||
|
|
||
| func TestParseAuthorizationToken(t *testing.T) { | ||
| var taskID int64 = 23 | ||
| token, err := CreateAuthorizationToken(taskID, 1, 2) | ||
| assert.Nil(t, err) | ||
| assert.NotEqual(t, "", token) | ||
| headers := http.Header{} | ||
| headers.Set("Authorization", "Bearer "+token) | ||
| rTaskID, err := ParseAuthorizationToken(&http.Request{ | ||
| Header: headers, | ||
| }) | ||
| assert.Nil(t, err) | ||
| assert.Equal(t, taskID, rTaskID) | ||
| } | ||
|
|
||
| func TestParseAuthorizationTokenNoAuthHeader(t *testing.T) { | ||
| headers := http.Header{} | ||
| rTaskID, err := ParseAuthorizationToken(&http.Request{ | ||
| Header: headers, | ||
| }) | ||
| assert.Nil(t, err) | ||
| assert.Equal(t, int64(0), rTaskID) | ||
| } |