ci: use Bearer header for git auth to Artifactory #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Resolve Dependencies (Artifactory OIDC) | |
| # Validate that SPM dependencies resolve through the curated Artifactory | |
| # pull-through cache via OIDC token exchange (ADR Rule 3). | |
| on: | |
| push: | |
| branches: [poc/**] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| resolve: | |
| runs-on: ubuntu-latest-large | |
| env: | |
| ARTIFACTORY_URL: https://twilio.jfrog.io | |
| SWIFT_VIRTUAL_REPO: virtual-swift-thirdparty | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Get Artifactory token via OIDC | |
| run: | | |
| set -euo pipefail | |
| OIDC_JWT=$(curl -sS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ARTIFACTORY_URL}" \ | |
| -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value') | |
| ART_TOKEN=$(curl -sS "${ARTIFACTORY_URL}/access/api/v1/oidc/token" \ | |
| -H 'Content-Type: application/json' \ | |
| -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\", | |
| \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", | |
| \"subject_token\":\"${OIDC_JWT}\", | |
| \"provider_name\":\"github-actions-segmentio\"}" | jq -r '.access_token') | |
| echo "::add-mask::$ART_TOKEN" | |
| echo "ART_TOKEN=$ART_TOKEN" >> "$GITHUB_ENV" | |
| - name: Verify Artifactory token | |
| run: | | |
| set -euo pipefail | |
| HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Authorization: Bearer ${ART_TOKEN}" \ | |
| "${ARTIFACTORY_URL}/artifactory/api/system/ping") | |
| echo "Artifactory ping: HTTP $HTTP_CODE" | |
| if [ "$HTTP_CODE" != "200" ]; then | |
| echo "::error::Artifactory token is invalid (HTTP $HTTP_CODE)" | |
| exit 1 | |
| fi | |
| - name: Debug git credential setup | |
| run: | | |
| echo "HOME=$HOME" | |
| echo "Runner user: $(whoami)" | |
| swift --version | |
| git --version | |
| - name: Configure SPM to resolve through Artifactory | |
| run: | | |
| set -euo pipefail | |
| MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}" | |
| # Configure git to pass the token as a Bearer header for Artifactory | |
| git config --global http.https://twilio.jfrog.io/.extraHeader \ | |
| "Authorization: Bearer ${ART_TOKEN}" | |
| swift package config set-mirror \ | |
| --original-url https://github.com/segmentio/sovran-swift.git \ | |
| --mirror-url "${MIRROR_BASE}/segmentio/sovran-swift.git" | |
| swift package config set-mirror \ | |
| --original-url https://github.com/segmentio/jsonsafeencoding-swift.git \ | |
| --mirror-url "${MIRROR_BASE}/segmentio/jsonsafeencoding-swift.git" | |
| - name: Resolve dependencies | |
| run: swift package resolve |