Skip to content

Harden CI: Artifactory OIDC, fork-aware workflows, SHA-pinned actions#208

Open
MichaelGHSeg wants to merge 1 commit into
v3.0from
ci/harden-build-publish
Open

Harden CI: Artifactory OIDC, fork-aware workflows, SHA-pinned actions#208
MichaelGHSeg wants to merge 1 commit into
v3.0from
ci/harden-build-publish

Conversation

@MichaelGHSeg

Copy link
Copy Markdown
Contributor

Summary

  • Add Artifactory OIDC composite action — exchanges GitHub OIDC token for short-lived Artifactory access token, sets `GOPROXY` to `virtual-go-thirdparty`
  • Replace `ci.yml` — fork-aware runner selection, Go 1.22–1.24 matrix, vet/test/build jobs, SHA-pinned actions
  • Update `e2e-tests.yml` + `publish-e2e-cli.yml` — remove `E2E_TESTS_TOKEN` (sdk-e2e-tests going public), fork-aware, SHA-pinned

Notes

  • No deploy workflow needed — Go publishes via git tags to the module proxy automatically
  • `go.sum` already committed; Go's integrity model is lockfile-equivalent

Test plan

  • CI runs on this PR
  • Artifactory OIDC exchange succeeds on same-repo CI
  • Before merging: set `ARTIFACTORY_URL` repository variable

- Add Artifactory OIDC composite action (sets GOPROXY to virtual-go-thirdparty)
- Replace ci.yml: fork-aware runner selection, Go 1.22-1.24 matrix, SHA-pinned
- Update e2e-tests.yml + publish-e2e-cli.yml: remove E2E_TESTS_TOKEN, fork-aware
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants