idtoken.go RawHistoryFolder

1// SPDX-License-Identifier: MIT
2
3package executor
4
5// addIDTokenEnv is the OIDC part of the handlers (ScriptHandler.cs:315-319,
6// NodeScriptActionHandler.cs:66-70, ContainerActionHandler.cs:232-236):
7// ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, which
8// @actions/core's getIDToken reads, for run steps, node actions and docker
9// actions. A composite action sets nothing itself: its steps get them from
10// their own handlers. Nothing is set unless the job has both (the server gives
11// them only to a trusted job with "id-token: write").
12func (j *job) addIDTokenEnv(env *ordered) {
13	if j.cfg.IDTokenURL == "" || j.cfg.IDTokenRequestToken == "" {
14		return
15	}
16	env.Set("ACTIONS_ID_TOKEN_REQUEST_URL", j.cfg.IDTokenURL)
17	env.Set("ACTIONS_ID_TOKEN_REQUEST_TOKEN", j.cfg.IDTokenRequestToken)
18}
19
20// scriptEnv returns the environment of the process of a run step: the env of
21// the step, plus the variables its handler adds (addIDTokenEnv). The env of
22// the step itself, which the env context and the header show, is left alone.
23func (j *job) scriptEnv(s *stepRun) *ordered {
24	env := s.env.Clone()
25	j.addIDTokenEnv(env)
26	return env
27}