1// SPDX-License-Identifier: MIT
2
3syntax = "proto3";
4
5package ermite;
6
7import "google/protobuf/timestamp.proto";
8
9// ServerService describes the server itself.
10service ServerService {
11 // GetVersion returns the server version and the optional capabilities of the
12 // contract it implements. It needs no authentication, so a client can call
13 // it first to check compatibility.
14 rpc GetVersion(GetVersionRequest) returns (GetVersionResponse);
15 // GetSigningKey returns the public key with which the server signs the
16 // commits it creates (squash merges, see MergeMode). It needs no
17 // authentication: the key is public, and anyone verifying a commit needs it.
18 // Servers that implement it list "signing_key" in
19 // GetVersionResponse.features.
20 rpc GetSigningKey(GetSigningKeyRequest) returns (GetSigningKeyResponse);
21 // RotateOIDCKey replaces the key with which the server signs the OIDC ID
22 // tokens of CI jobs (Job.id_token_url) by a new one. The previous key stops
23 // signing at once but stays in the server's JWKS
24 // ("/-/oidc/.well-known/jwks") for 24 hours, so that tokens it signed still
25 // verify until they expire. It needs owner rights: the admin token, the
26 // owner's session, or a token with every scope and no repository list or
27 // branch prefixes (permission_denied otherwise). It fails with
28 // failed_precondition when the server issues no ID tokens (it has no
29 // secrets key to seal the key with). Servers that implement it list
30 // "ci.oidc" in GetVersionResponse.features.
31 rpc RotateOIDCKey(RotateOIDCKeyRequest) returns (RotateOIDCKeyResponse);
32}
33
34// GetVersionRequest is empty.
35message GetVersionRequest {}
36
37// GetVersionResponse describes the running server.
38message GetVersionResponse {
39 // Version is the server release, for example "v0.4.0", or "devel" for an
40 // untagged build. Informational: clients must not compare it to decide what
41 // is supported, they use features instead.
42 string version = 1;
43 // Features lists identifiers of the optional capabilities of the contract
44 // that this server implements, for example "repo.update" or
45 // "events.resume". A client that needs a capability missing from this list
46 // should warn instead of failing on an unimplemented RPC or ignored field.
47 // Identifiers are lowercase, dot-separated and never reused. The CI
48 // identifiers are "ci.runs" (RunService runs, jobs, logs, checks, and the
49 // run_updated and job_updated events), "ci.runs.filters" (ListRuns honours
50 // its filters) and "ci.runners" (RunnerService, and RunService.ListRunners
51 // and RemoveRunner). The CI execution identifiers are "ci.actions"
52 // (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
53 // (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
54 // and "ci.summaries" (RunnerService.UploadSummary and
55 // RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
56 // (SecretService, VariableService and EnvironmentService, and in Job the
57 // secrets, vars, environment, permissions and trusted fields and Run.trusted),
58 // "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
59 // (CI_STATUS_PENDING and RunJob.concurrency_group), "ci.cache" (Job.cache)
60 // and "ci.artifacts" (JobArtifactService and ArtifactService).
61 repeated string features = 2;
62}
63
64// GetSigningKeyRequest is empty.
65message GetSigningKeyRequest {}
66
67// GetSigningKeyResponse describes the commit signing key of the server.
68message GetSigningKeyResponse {
69 // PublicKey is the public key as one OpenSSH authorized_keys line, for
70 // example "ssh-ed25519 AAAA...". Commits are signed in the SSH signature
71 // format (SSHSIG).
72 string public_key = 1;
73 // Fingerprint is the SHA-256 fingerprint of the key, in the form
74 // "SHA256:<base64>" that ssh-keygen prints.
75 string fingerprint = 2;
76 // CommitterName is the name the server records as the committer of the
77 // commits it creates.
78 string committer_name = 3;
79 // CommitterEmail is the email address the server records as the committer of
80 // the commits it creates. It is the principal of allowed_signers.
81 string committer_email = 4;
82 // AllowedSigners is a ready-to-use line for an allowed signers file
83 // ("<committer_email> <public_key>"), to verify these commits with
84 // "git config gpg.ssh.allowedSignersFile".
85 string allowed_signers = 5;
86}
87
88// RotateOIDCKeyRequest is empty.
89message RotateOIDCKeyRequest {}
90
91// RotateOIDCKeyResponse describes the new signing key of the ID tokens.
92message RotateOIDCKeyResponse {
93 // Issuer is the "iss" of the ID tokens, for example
94 // "https://git.example.com/-/oidc". Its discovery document is at
95 // "<issuer>/.well-known/openid-configuration".
96 string issuer = 1;
97 // Kid is the key id of the new key, the "kid" of the tokens it signs: the
98 // RFC 7638 thumbprint of its public key, base64url without padding.
99 string kid = 2;
100 // RetiredKid is the key id of the key it replaces; empty when there was
101 // none.
102 string retired_kid = 3;
103 // RetiredUntil is when the replaced key leaves the JWKS. Unset when there
104 // was none.
105 google.protobuf.Timestamp retired_until = 4;
106}