unkin/rpmbuilder
4
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

ci: authenticate artifactapi upload with a vault token #189

Merged
benvin merged 1 commits from benvin/artifactapi-upload-token into master 2026-10-25 23:07:55 +11:00
Conversation 1 Commits 1 Files Changed 4
+32 -4
unkin-agent commented 2026-10-25 20:32:57 +11:00
Member
Copy Link
Copy Source

artifactapi is about to enforce auth on file uploads (ARTIFACTAPI_AUTH_UPLOADS), and the deploy pipelines PUT rpms anonymously.

  • mint an artifactapi-writer OIDC token via Vault k8s auth (role woodpecker_artifactapi_writer) using the step SA token
  • fail the step if minting fails (set -o pipefail)
  • send the token as Authorization: Bearer via a header file on each rpm PUT
  • apply to the almalinux9, fedora42, fedora43 and fedora44 deploy pipelines
artifactapi is about to enforce auth on file uploads (`ARTIFACTAPI_AUTH_UPLOADS`), and the deploy pipelines PUT rpms anonymously. - mint an `artifactapi-writer` OIDC token via Vault k8s auth (role `woodpecker_artifactapi_writer`) using the step SA token - fail the step if minting fails (`set -o pipefail`) - send the token as `Authorization: Bearer` via a header file on each rpm PUT - apply to the almalinux9, fedora42, fedora43 and fedora44 deploy pipelines
unkin-agent added 1 commit 2026-10-25 20:32:57 +11:00
ci: authenticate rpm uploads with a vault-minted artifactapi token
ci/woodpecker/pr/build-fedora42 Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build-fedora43 Pipeline was successful
Details
ci/woodpecker/pr/build-almalinux9 Pipeline was successful
Details
ci/woodpecker/pr/build-fedora44 Pipeline was successful
Details
145d96761c
unkin-agent commented 2026-10-25 20:36:49 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit c333ea078d into master 2026-10-25 23:07:55 +11:00
benvin deleted branch benvin/artifactapi-upload-token 2026-10-25 23:07:55 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) droneci unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/rpmbuilder#189
Delete Branch "benvin/artifactapi-upload-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?