17 commits

Author	SHA1	Message	Date
Brian Lalor	12060449e8	Add selective retries for STS token exchange (#532) ... ## Summary The workload identity flow retries GitHub OIDC token retrieval, but `@actions/http-client` does not retry the POST to Google Security Token Service. A transient connection reset or socket timeout therefore ends authentication on the first failed exchange. This change adds four bounded STS attempts with 100, 200, and 400 ms backoffs. Retries are limited to connection failures and HTTP 408, 429, 500, 502, 503, and 504 responses. HTTP 400, 401, 403, empty responses, and unknown errors fail without retrying. Attempt diagnostics contain only the operation, STS hostname, status or classified error, and attempt count. The existing STS request and computed-audience debug messages were removed so these diagnostics do not include the OIDC assertion, returned access token, headers, credential data, service account, or workload identity provider resource. Mocked tests cover each retryable HTTP status, connection errors, the uncoded `@actions/http-client` socket timeout, permanent HTTP failures, the four-attempt limit, and diagnostic redaction.	2026-07-29 16:22:35 -04:00
Seth Vargo	aaf2e69f95	Update deps (#384)	2024-01-22 21:04:58 -05:00
Seth Vargo	7c4e01fd00	Make auth universe-aware (#352) ... This adds support for making the action "universe" aware, so it will be usable for TPC and GDCH.	2023-11-28 21:59:39 -05:00
Seth Vargo	fe9207673e	Add support for Direct Workload Identity auth (#348) ... This adds a new authentication mode, Direct Workload Identity Federation. This new mode permits authenticating to Google Cloud directly using the GitHub Actions OIDC token instead of proxying through a Google Cloud Service Account.	2023-11-28 10:41:10 -05:00
Seth Vargo	04900d1e97	Drop chai and mocha deps (#342)	2023-11-15 08:33:15 -05:00
Seth Vargo	48c46e6a59	feat: ensure cred file is created with a predictable name (#130)	2022-02-03 11:57:50 -06:00
Seth Vargo	736e11de40	chore: update deps and use isEmptyDir from utils (#119)	2022-01-26 17:47:12 -06:00
Seth Vargo	983a037dfb	feat: emit a warning when the workspace is empty (#117) ... There have been a number of GitHub issues recently due to users not adding actions/checkout before calling "auth", which makes the credentials unavailable to future steps. Worse, some people are putting checkout _after_ auth, which overwrites the generated credentials with a checkout of the repo. This adds a feature that emits a warning with the workspace is empty.	2022-01-26 15:27:51 -05:00
Seth Vargo	ec59fe8c8e	fix: switch to actions-utils and update deps (#91)	2021-12-22 10:45:18 -05:00
Seth Vargo	ccc7806970	Emit a better error when OIDC information is missing (#81)	2021-12-09 12:52:57 -05:00
Seth Vargo	1618f1c032	Add another test for fromBase64 (#76)	2021-12-07 10:22:31 -06:00
Seth Vargo	8708e498da	Add support for Domain-Wide Delegation (#70)	2021-12-02 10:17:06 -06:00
Seth Vargo	057960bb62	Add util function for parsing durations and many more tests (#69)	2021-12-01 16:13:51 -05:00
Seth Vargo	1e9245c68a	Clean up exported credentials when the workflow finishes (#67) ... * Clean up exported credentials when the workflow finishes * Fix conditional and log	2021-12-01 11:38:47 -06:00
Seth Vargo	c6fa692def	Use strict everywhere (#68)	2021-11-30 13:23:28 -08:00
Seth Vargo	2f0b4dbd9b	Add support for specifying authentication via JSON service account keys (#37) ... * Add support for specifying authentication via JSON service account keys * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Review feedback * Undo interface * Use TokenCreator instead Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>	2021-11-08 17:13:59 -05:00
Seth Vargo	688a7bd017	Initial commit	2021-09-16 12:54:29 -04:00