feat: Add ability to use GitHub OIDC #161
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅ ✅ All tests successful. No failed tests found.
📢 Thoughts on this report? Let us know! |
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. Additional details and impacted files
☔ View full report in Codecov by Sentry. |
Bundle ReportChanges will increase total bundle size by 183.02kB ⬆️
|
Bundle ReportChanges will increase total bundle size by 446.46kB ⬆️
|
nicholas-codecov
force-pushed
the
gh-eng-2209-add-ability-to-use-github-oidc
branch
from
9d5df6b to
63ac370
Compare
| url = output.oidc.OIDCEndpoint; | ||
| let token = ""; | ||
| try { | ||
| token = await Core.getIDToken(output.oidc.OIDCEndpoint); |
There was a problem hiding this comment.
From the docs, it seems we need to pass to getIDToken() the audience to match that as we set in codecov-api here.
For example in prod that would be either settings.CODECOV_API_URL = https://api.codecov.io or settings.CODECOV_URL = https://codecov.io
Given that I think we should name that variable something like gitHubOIDCTokenAudience
There was a problem hiding this comment.
So the audience is the OIDC endpoint, which I can rename to your suggestion. To implement this I followed along with how we have this done up in our action
There was a problem hiding this comment.
Ah gotcha. I'd argue the variable over there is misnamed too 🙃 . And arguably relying on a (potentially changing) implementation detail of our codecov-api server.
As in re: "the audience is the OIDC endpoint" - that works as long as the server consuming the JWT token issued through GitHub OIDC validates the JWT expecting the audience to be the same string as the url host. Which may not always hold true, but happens to in our case. Other servers perhaps may be hosted at https://mysubdomain.myhost.com while the audience is expected to be https://*.myhost.com or https://myhost.com or other..
In any case I like what you've got here now - thank you for all this!
| * | ||
| * Defaults to `https://codecov.io` | ||
| */ | ||
| OIDCEndpoint?: string; |
There was a problem hiding this comment.
(See other PR comment re: this variable.)
Technically, something like below may be a little clearer:
/**
* The expected audience in the GitHub OIDC JWT token to be validated by the apiUrl.
*
* Defaults to `https://codecov.io`
*/
gitHubOIDCTokenAudience?: string;
The value of this string needs to match that at codecov-api here.
We are never actually hitting this "endpoint" and technically the value of this doesn't need to be a url at all.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
packages/bundler-plugin-core/src/utils/__tests__/getPreSignedURL.test.ts
Dismissed
Show dismissed
Hide dismissed
packages/bundler-plugin-core/src/utils/__tests__/getPreSignedURL.test.ts
Dismissed
Show dismissed
Hide dismissed
packages/bundler-plugin-core/src/utils/__tests__/getPreSignedURL.test.ts
Dismissed
Show dismissed
Hide dismissed
packages/bundler-plugin-core/src/utils/__tests__/getPreSignedURL.test.ts
Dismissed
Show dismissed
Hide dismissed
packages/bundler-plugin-core/src/utils/__tests__/getPreSignedURL.test.ts
Dismissed
Show dismissed
Hide dismissed
| red( | ||
| `Failed to get OIDC token with url:\`${oidc.gitHubOIDCTokenAudience}\`. ${err.message}`, | ||
| ); | ||
| throw new FailedOIDCFetchError( |
There was a problem hiding this comment.
we should attach err as the error.cause of the FailedOIDCFetchError
There was a problem hiding this comment.
Hrm, I'm getting type errors trying to add a second argument to Error, I see it in the MDN docs. I tried updating the @types/node however that didn't resolve the issue, any other ideas/guidance 👀
There was a problem hiding this comment.
Hmm it might be because of the tsconfig here:
try setting it to be ES2022?
if that doesn't work feel free to ignore this and more forward.
There was a problem hiding this comment.
ahh yea that did the trick
nicholas-codecov
deleted the
gh-eng-2209-add-ability-to-use-github-oidc
branch
Description
This PR adds in support for using GitHub OIDC with the bundler plugins.
Closes codecov/engineering-team#2209
Notable Changes
@actions/corepackagegetPreSignedUrlto grab the token through GitHub OIDC