Repository navigation
test oidc flow - #912
test oidc flow#912holgpar wants to merge 1 commit into
Conversation
![hyperspace-pr-bot[bot]](https://avatars.githubusercontent.com/u/2531208?s=60&v=4){kind=small}
There was a problem hiding this comment.
The workflow has correctness and credential-handling issues that should be addressed before merging. In particular, ensure both trigger paths receive valid configuration and the issued token remains masked throughout execution.
PR Bot Information
Version: 1.33.28
- Event Trigger:
pull_request.opened - Experiment Variant:
control - LLM:
gpt-5.6-sol - Correlation ID:
8beae530-d762-11f1-8cdd-12f0521f1f4a - Agent Instructions:
- File Content Strategy: Full file content
| push: | ||
| branches: | ||
| - holger/oidcSetup |
There was a problem hiding this comment.
Bug: Push runs do not receive the workflow_dispatch input defaults
On a push to this branch, every ${{ inputs.* }} value used below is empty, so the workflow reaches cf api '' and cannot perform the advertised login test. Consider either making this workflow dispatch-only or defining job-level fallback values for push runs.
Please provide feedback on the review comment by checking the appropriate box:
- 🌟 Awesome comment, a human might have missed that.
- ✅ Helpful comment
- 🤷 Neutral
- ❌ This comment is not helpful
| echo "JWT header + payload (decoded):" | ||
| echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson' | ||
| echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
Security: The newly fetched ID token is not registered as a masked value
The token is subsequently expanded from the step output into another run script, so the runner can expose this bearer credential in workflow logs. Mask it before publishing the output so all later occurrences are redacted.
| echo "JWT header + payload (decoded):" | |
| echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson' | |
| echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT" | |
| echo "::add-mask::$githubJwt" | |
| echo "JWT header + payload (decoded):" | |
| echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson' | |
| echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT" |
Double-check suggestion before committing. Edit this comment for amendments.
Please provide feedback on the review comment by checking the appropriate box:
- 🌟 Awesome comment, a human might have missed that.
- ✅ Helpful comment
- 🤷 Neutral
- ❌ This comment is not helpful
d59b22b to
eed48d1
Compare
Add GitHub OIDC Authentication Test for Cloud Foundry
New Features
✨ Added a GitHub Actions workflow to validate passwordless Cloud Foundry authentication using a GitHub-issued OIDC token. The workflow supports manual configuration and verifies access by targeting a specified organization and space.
Changes
.github/workflows/oidc-cf-login-test.yml: Added an OIDC login test workflow that:PR Bot Information
Version:
1.33.28pull_request.openedgpt-5.6-sol8beae530-d762-11f1-8cdd-12f0521f1f4a