Skip to content

test oidc flow #912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
holgpar wants to merge 1 commit into
base: main
Choose a base branch
from
Open

test oidc flow #912

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/workflows/oidc-cf-login-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
name: OIDC CF Login Test

on:
push:
branches:
- holger/oidcSetup
Comment on lines +4 to +6

@hyperspace-pr-bot hyperspace-pr-bot Bot Nov 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Push runs do not receive the workflow_dispatch input defaults

On a push to this branch, every ${{ inputs.* }} value used below is empty, so the workflow reaches cf api '' and cannot perform the advertised login test. Consider either making this workflow dispatch-only or defining job-level fallback values for push runs.

Please provide feedback on the review comment by checking the appropriate box:

  • 🌟 Awesome comment, a human might have missed that.
  • ✅ Helpful comment
  • 🤷 Neutral
  • ❌ This comment is not helpful

workflow_dispatch:
inputs:
cfApiEndpointUrl:
description: 'Cloud Foundry API endpoint'
default: 'https://api.cf.eu12-001.hana.ondemand.com'
required: true
type: string
cfOrg:
description: 'CF org name'
default: 'CAP-PLUGINS-DEV_ci-aws-mjy1tj90'
required: true
type: string
cfSpace:
description: 'CF space name'
default: 'ci-java'
required: true
type: string
userOrigin:
description: 'Origin-identifier of the platform IdP'
default: 'aarz7ikup-platform'
required: true
type: string
tenantIssuerUri:
description: 'Issuer URI of the SAP Cloud Identity Services tenant'
default: 'https://aarz7ikup.accounts400.ondemand.com'
required: true
type: string

jobs:
oidc-login-test:
name: OIDC CF Login Test
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
id-token: write # required for requesting the GitHub-issued JWT
contents: read

env:
CF_API: ${{ inputs.cfApiEndpointUrl || 'https://api.cf.eu12-001.hana.ondemand.com' }}
CF_ORG: ${{ inputs.cfOrg || 'CAP-PLUGINS-DEV_ci-aws-mjy1tj90' }}
CF_SPACE: ${{ inputs.cfSpace || 'ci-java' }}
CF_USER_ORIGIN: ${{ inputs.userOrigin || 'aarz7ikup-platform' }}
CIS_ISSUER_URI: ${{ inputs.tenantIssuerUri || 'https://aarz7ikup.accounts400.ondemand.com' }}

steps:
- name: Show provided parameters
run: |
echo "CF_API=$CF_API"
echo "CF_ORG=$CF_ORG"
echo "CF_SPACE=$CF_SPACE"
echo "CF_USER_ORIGIN=$CF_USER_ORIGIN"
echo "CIS_ISSUER_URI=$CIS_ISSUER_URI"

- name: Install CF CLI
env:
CF_CLI_VERSION: '8.18.3'
run: |
wget -q "https://packages.cloudfoundry.org/stable?release=linux64-binary&version=${CF_CLI_VERSION}&source=github-rel" -O cf-cli.tar.gz
tar -xzf cf-cli.tar.gz
sudo mv cf8 /usr/local/bin/cf
cf --version

- name: Get GitHub-issued JWT
id: get-github-jwt
run: |
githubJwt=$(curl -s \
-H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
-H "Accept: application/json; api-version=2.0" \
-H "Content-Type: application/json" \
"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$CIS_ISSUER_URI" \
| jq -r '.value')
echo "JWT header + payload (decoded):"
echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson'
echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT"
Comment on lines +78 to +80

@hyperspace-pr-bot hyperspace-pr-bot Bot Nov 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security: The newly fetched ID token is not registered as a masked value

The token is subsequently expanded from the step output into another run script, so the runner can expose this bearer credential in workflow logs. Mask it before publishing the output so all later occurrences are redacted.

Suggested change
echo "JWT header + payload (decoded):"
echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson'
echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT"
echo "::add-mask::$githubJwt"
echo "JWT header + payload (decoded):"
echo "$githubJwt" | jq -R 'split(".") | .[0],.[1] | @base64d | fromjson'
echo "githubJwt=$githubJwt" >> "$GITHUB_OUTPUT"

Double-check suggestion before committing. Edit this comment for amendments.

Please provide feedback on the review comment by checking the appropriate box:

  • 🌟 Awesome comment, a human might have missed that.
  • ✅ Helpful comment
  • 🤷 Neutral
  • ❌ This comment is not helpful


- name: Set CF API endpoint
run: cf api "$CF_API"

- name: Login to CF via OIDC assertion
run: cf auth --assertion "${{ steps.get-github-jwt.outputs.githubJwt }}" --origin "$CF_USER_ORIGIN"

- name: Target CF org and space
run: cf target -o "$CF_ORG" -s "$CF_SPACE"

- name: Show CF info
run: |
cf orgs
cf spaces
cf target

- name: Logout from CF
if: always()
run: cf logout
Loading