Add SemaphoreCI OIDC trusted provider support #19048
Conversation
warehouse/migrations/versions/7a97c540ed60_add_semaphoreci_oidc_models.py
Outdated
Show resolved
Hide resolved
| from sqlalchemy.orm import Session | ||
|
|
||
|
|
||
| SEMAPHORE_OIDC_ISSUER_URL_SUFFIX = ".semaphoreci.com" |
There was a problem hiding this comment.
This is interesting! Generally our model has been either to support a specific issuer URL or to support custom issuer URLs on a per-organization basis.
Does this mean that there is a different issuer for every SemaphoreCI project? Or generally, what are the expected values here?
There was a problem hiding this comment.
Does this mean that there is a different issuer for every SemaphoreCI project? Or generally, what are the expected values here?
Yes, the expected values are of the format https://<org-name>.semaphoreci.com where org-name is the name of the Semaphore organization (not the GitHub organization). Ref https://docs.semaphore.io/reference/openid#reference.
I think the best way to test this would be to put it behind a feature flag and enable it only for test.pypi.org first. |
warehouse/migrations/versions/7a97c540ed60_add_semaphoreci_oidc_models.py
Outdated
Show resolved
Hide resolved
|
@cchristous FYI you have linting errors here |
I thought had everything passing, but clearly not. Sorry about that. I ran |
2 participants
This attempts to implement #18882.
The automated tests are all passing, but I don't have confidence this actually works because I don't know how to test the actual integration. I have access to and familiarity with Semaphore, and I could test using the 2 SaaS services, if the warehouse were deployed. Though, I am hoping there is an easier way to test this, so I could use some guidance on how to proceed.