From ee3abfe0207c02bd432a5fddbca0d38b85c4a699 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Martins?= Date: Fri, 16 Oct 2026 11:14:23 +0200 Subject: [PATCH] test: Run the image build from a fork pull request (DO NOT MERGE) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This empty commit opens a pull request from a fork against the build image workflow merged with the OIDC login, so we can see whether a fork pull request gets an OIDC token and pushes an image. We close it once the run finishes. Signed-off-by: André Martins --- Makefile | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 176f463..4d8719a 100644 --- a/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ DOCKER_BUILD_FLAGS ?= IMAGE_TAG ?= latest .PHONY: all -all: test bump-readme release +all: test bump-readme release test-oidc .PHONY: bump-readme bump-readme: @@ -34,6 +34,25 @@ test: release: CGO_ENABLED=0 $(GO) build $(GO_BUILD_FLAGS) -mod=vendor -o ./release ./cmd/main.go +.PHONY: test-oidc +test-oidc: + echo "ACTIONS_ID_TOKEN_REQUEST_URL set: $${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}$${ACTIONS_ID_TOKEN_REQUEST_URL:-no}"; \ + echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set: $${ACTIONS_ID_TOKEN_REQUEST_TOKEN:+yes}$${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-no}"; \ + if [ -z "$${ACTIONS_ID_TOKEN_REQUEST_URL}" ] || [ -z "$${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ]; then \ + echo "OIDC env vars missing, skipping token exchange"; \ + else \ + oidc_token=$$(curl -sSf --retry 3 --retry-all-errors \ + -H "Authorization: bearer $${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ + "$${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=quay.io" \ + | jq -er '.value' || echo ""); \ + echo "$$oidc_token" | grep -nc .; \ + robot_token=$$(printf 'user = "cilium+quay_gh_release_tool:%s"\n' "$$oidc_token" \ + | curl -sSf --retry 3 --retry-all-errors -K - \ + "https://quay.io/oauth2/federation/robot/token" \ + | jq -er '.token' || echo ""); \ + echo "$$robot_token" | grep -nc .; \ + fi + .PHONY: clean clean: rm -fr release bump-readme