ci: fix auth with git insteadOf, limit trigger to poc branches #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Resolve Dependencies (Artifactory OIDC) | |
| # Validate that SPM dependencies resolve through the curated Artifactory | |
| # pull-through cache via OIDC token exchange (ADR Rule 3). | |
| on: | |
| push: | |
| branches: [poc/**] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| resolve: | |
| runs-on: ubuntu-latest-large | |
| env: | |
| ARTIFACTORY_URL: https://twilio.jfrog.io | |
| SWIFT_VIRTUAL_REPO: virtual-swift-thirdparty | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Get Artifactory token via OIDC | |
| run: | | |
| set -euo pipefail | |
| OIDC_JWT=$(curl -sS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ARTIFACTORY_URL}" \ | |
| -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value') | |
| ART_TOKEN=$(curl -sS "${ARTIFACTORY_URL}/access/api/v1/oidc/token" \ | |
| -H 'Content-Type: application/json' \ | |
| -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\", | |
| \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", | |
| \"subject_token\":\"${OIDC_JWT}\", | |
| \"provider_name\":\"github-actions-segmentio\"}" | jq -r '.access_token') | |
| echo "::add-mask::$ART_TOKEN" | |
| echo "ART_TOKEN=$ART_TOKEN" >> "$GITHUB_ENV" | |
| - name: Verify Artifactory token | |
| run: | | |
| set -euo pipefail | |
| HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Authorization: Bearer ${ART_TOKEN}" \ | |
| "${ARTIFACTORY_URL}/artifactory/api/system/ping") | |
| echo "Artifactory ping: HTTP $HTTP_CODE" | |
| if [ "$HTTP_CODE" != "200" ]; then | |
| echo "::error::Artifactory token is invalid (HTTP $HTTP_CODE)" | |
| exit 1 | |
| fi | |
| - name: Debug git credential setup | |
| run: | | |
| echo "HOME=$HOME" | |
| echo "Runner user: $(whoami)" | |
| swift --version | |
| git --version | |
| - name: Configure SPM to resolve through Artifactory | |
| run: | | |
| set -euo pipefail | |
| MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}" | |
| # Configure git credentials via URL-specific helper | |
| git config --global "url.https://token:${ART_TOKEN}@twilio.jfrog.io/.insteadOf" \ | |
| "https://twilio.jfrog.io/" | |
| swift package config set-mirror \ | |
| --original-url https://github.com/segmentio/sovran-swift.git \ | |
| --mirror-url "${MIRROR_BASE}/segmentio/sovran-swift.git" | |
| swift package config set-mirror \ | |
| --original-url https://github.com/segmentio/jsonsafeencoding-swift.git \ | |
| --mirror-url "${MIRROR_BASE}/segmentio/jsonsafeencoding-swift.git" | |
| - name: Resolve dependencies | |
| run: swift package resolve |