10 commits

Author	SHA1	Message	Date
Brian Lalor	12060449e8	Add selective retries for STS token exchange (#532) ... ## Summary The workload identity flow retries GitHub OIDC token retrieval, but `@actions/http-client` does not retry the POST to Google Security Token Service. A transient connection reset or socket timeout therefore ends authentication on the first failed exchange. This change adds four bounded STS attempts with 100, 200, and 400 ms backoffs. Retries are limited to connection failures and HTTP 408, 429, 500, 502, 503, and 504 responses. HTTP 400, 401, 403, empty responses, and unknown errors fail without retrying. Attempt diagnostics contain only the operation, STS hostname, status or classified error, and attempt count. The existing STS request and computed-audience debug messages were removed so these diagnostics do not include the OIDC assertion, returned access token, headers, credential data, service account, or workload identity provider resource. Mocked tests cover each retryable HTTP status, connection errors, the uncoded `@actions/http-client` socket timeout, permanent HTTP failures, the four-attempt limit, and diagnostic redaction.	2026-07-29 16:22:35 -04:00
Seth Vargo	aaf2e69f95	Update deps (#384)	2024-01-22 21:04:58 -05:00
Seth Vargo	7c4e01fd00	Make auth universe-aware (#352) ... This adds support for making the action "universe" aware, so it will be usable for TPC and GDCH.	2023-11-28 21:59:39 -05:00
Seth Vargo	fe9207673e	Add support for Direct Workload Identity auth (#348) ... This adds a new authentication mode, Direct Workload Identity Federation. This new mode permits authenticating to Google Cloud directly using the GitHub Actions OIDC token instead of proxying through a Google Cloud Service Account.	2023-11-28 10:41:10 -05:00
Seth Vargo	04900d1e97	Drop chai and mocha deps (#342)	2023-11-15 08:33:15 -05:00
Seth Vargo	48c46e6a59	feat: ensure cred file is created with a predictable name (#130)	2022-02-03 11:57:50 -06:00
Seth Vargo	ccc7806970	Emit a better error when OIDC information is missing (#81)	2021-12-09 12:52:57 -05:00
Seth Vargo	8708e498da	Add support for Domain-Wide Delegation (#70)	2021-12-02 10:17:06 -06:00
Seth Vargo	c6fa692def	Use strict everywhere (#68)	2021-11-30 13:23:28 -08:00
Seth Vargo	2f0b4dbd9b	Add support for specifying authentication via JSON service account keys (#37) ... * Add support for specifying authentication via JSON service account keys * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Review feedback * Undo interface * Use TokenCreator instead Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>	2021-11-08 17:13:59 -05:00