From 57b8137196ef7ea17ad3d12ff1b7fe06d273ee59 Mon Sep 17 00:00:00 2001 From: Amp Date: Sun, 16 Aug 2026 21:25:09 +0000 Subject: [PATCH] Add OIDC plugin configuration Amp-Thread-ID: https://ampcode.com/threads/T-01a00c73-69ad-710b-ad27-e00153ef7ec8 Co-authored-by: Lachlan Donald --- README.md | 23 +++++++++++++++++++++-- plugin.yml | 19 +++++++++++++++++++ tests/command.bats | 7 +++++++ 3 files changed, 47 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 26ec13d..a0e2f7a 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ Configure runtime selection with the following properties: | `source-ref` | No | — | Full `buildkite-gha` source commit to build for development testing; mutually exclusive with `version`. | | `minimum-release-age` | No | `0s` | Minimum release age used by mise when resolving `latest`. | | `experimental-runner-user` | No | `false` | Run generated Linux jobs as a dedicated `runner` user; requires `buildkite-gha` 0.13.7 or newer. | +| `oidc` | No | — | Buildkite OIDC token options for jobs that request GitHub-compatible OIDC. Requires a `buildkite-gha` release with OIDC support. | | `runners` | No | — | Exact `runs-on` mappings to Buildkite queues and optional immutable Linux image overrides. | > [!NOTE] @@ -45,7 +46,7 @@ Configure runtime selection with the following properties: To test unreleased runtime behavior, set `source-ref` to a full lowercase 40-character commit from the public `buildkite/buildkite-gha` repository and omit `version`. The plugin uses mise and Go 1.26.5 to build Linux amd64 and Darwin arm64 executables from that exact source, runs the executable native to the importer agent, and supplies the counterpart to generated jobs. Source commits are for development only and do not use release checksums, attestations, or `minimum-release-age`. -The plugin schema requires exactly one of `workflow` or `workflows` and validates its explicit paths, the runtime-acquisition fields `version`, `source-ref`, and `minimum-release-age`, and the boolean `experimental-runner-user` field. It passes behavioral configuration through to the selected `buildkite-gha` runtime, which validates the complete configuration strictly. This allows runtime releases to extend the supported syntax without requiring a companion plugin release. +The plugin schema requires exactly one of `workflow` or `workflows` and validates its explicit paths, the runtime-acquisition fields `version`, `source-ref`, and `minimum-release-age`, the boolean `experimental-runner-user` field, and the admission-level shape of `oidc`. It passes behavioral configuration through to the selected `buildkite-gha` runtime, which validates the complete configuration strictly. This allows runtime releases to extend the supported syntax without requiring a companion plugin release. ### Select workflows @@ -93,6 +94,24 @@ steps: This experimental mode requires `buildkite-gha` 0.13.7 or newer. The generated Linux job must initially run as root so the runtime can provision the user; that user retains passwordless `sudo`, so this is not a security boundary. The option is off by default and does not change macOS jobs. +### Configure OIDC tokens + +Use the `oidc` block to configure pipeline-owner options for GitHub-compatible OIDC tokens: + +```yaml +plugins: + - github-actions#latest: + workflow: .github/workflows/deploy.yml + oidc: + claims: [organization_id] + aws-session-tags: [organization_slug, pipeline_id] + subject-claim: pipeline_id +``` + +This configuration requires a `buildkite-gha` release with OIDC support. Releases without that support reject the `oidc` block during strict behavioral configuration validation, so do not enable it until a supporting runtime release is selected. + +The block only affects jobs that already declare `permissions: id-token: write`; it does not grant OIDC access to other jobs or change the workflow itself. `claims` adds optional claims to tokens, `aws-session-tags` duplicates claims into AWS session-tag format, and `subject-claim` selects one immutable claim as the token subject. The accepted values match [`buildkite-agent oidc request-token`](https://buildkite.com/docs/agent/cli/reference/oidc) and are validated by `buildkite-gha`. + The supported top-level triggers map to group `if` expressions as follows: | GitHub Actions trigger | Buildkite condition | @@ -242,7 +261,7 @@ The public preview supports an evolving subset of GitHub Actions. Common support Important limitations include: -- General workflow secrets, ambient `GITHUB_TOKEN`, private actions, private reusable workflows, alternate-repository or alternate-ref checkout, and GitHub-compatible OIDC are not available. +- General workflow secrets, ambient `GITHUB_TOKEN`, private actions, private reusable workflows, and alternate-repository or alternate-ref checkout are not available. - Windows and Linux arm64 jobs are not supported. - macOS does not provide GitHub-hosted image or Xcode inventory parity. Docker actions, job containers, and service containers are not supported on macOS. - Job and service containers are not available through the production plugin path. diff --git a/plugin.yml b/plugin.yml index a641a99..4f01361 100644 --- a/plugin.yml +++ b/plugin.yml @@ -47,4 +47,23 @@ configuration: type: boolean default: false description: Run generated Linux jobs as a dedicated runner user. Requires buildkite-gha 0.13.7 or newer. + oidc: + type: object + properties: + claims: + type: array + items: + type: string + minLength: 1 + description: Optional claim names to include in Buildkite OIDC tokens. + aws-session-tags: + type: array + items: + type: string + minLength: 1 + description: Claim names to duplicate into AWS session-tag format. + subject-claim: + type: string + minLength: 1 + description: Immutable claim name to use as the token subject. additionalProperties: true diff --git a/tests/command.bats b/tests/command.bats index 1aa5ae4..1c57eba 100755 --- a/tests/command.bats +++ b/tests/command.bats @@ -203,6 +203,13 @@ teardown() { rm -rf "$TMP"; } grep -Fx "configuration=$BUILDKITE_PLUGIN_CONFIGURATION" "$MOCK_LOG" } +@test "passes OIDC configuration to buildkite-gha unchanged" { + export BUILDKITE_PLUGIN_CONFIGURATION='{"workflow":".github/workflows/deploy.yml","oidc":{"claims":["organization_id"],"aws-session-tags":["organization_slug","pipeline_id"],"subject-claim":"pipeline_id"}}' + run "$REPO/hooks/command" + [ "$status" -eq 0 ] || { echo "$output"; false; } + grep -Fx "configuration=$BUILDKITE_PLUGIN_CONFIGURATION" "$MOCK_LOG" +} + @test "passes experimental-runner-user to the native source importer" { commit=abcdef0123456789abcdef0123456789abcdef01 export BUILDKITE_PLUGIN_GITHUB_ACTIONS_SOURCE_REF="$commit"