Skip to content

add circleci info to fulcio #2192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
haydentherapper merged 6 commits into from
Nov 19, 2025
Merged

add circleci info to fulcio #2192

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b4367cd
add required information for onboarding circleci into fulcio
meeech Nov 13, 2025
3bafa86
add SAN that copies what gha is doing
meeech Nov 13, 2025
68986ac
add some logic to runner_environment
meeech Nov 18, 2025
d830f0e
adjust how we handle template fragments to account for keys with spec…
meeech Nov 18, 2025
82de652
add a test for claim key with . and / in it
meeech Nov 18, 2025
2159a8a
remove unneeded default claim value
meeech Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions config/identity/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ define:
- &gitlab-type "gitlab-pipeline"
- &codefresh-type "codefresh-workflow"
- &buildkite-type "buildkite-job"
- &circleci-type "circleci-job"
oidc-issuers:
https://accounts.google.com:
issuer-url: https://accounts.google.com
Expand Down Expand Up @@ -262,3 +263,21 @@ ci-issuer-metadata:
# build_source: Event that triggered this workflow run. (valid values: api, ui, webhook, trigger_job, schedule)
build-trigger: "build_source"
subject-alternative-name-template: "{{.url}}/{{.organization_slug}}/{{.pipeline_slug}}" # seems correct, do we still need the code in pkg/identity/buildkite/principal.go ?
*circleci-type:
default-template-values:
# principal gives priority to the claimed value over the default
api_url: "https://circleci.com/api/v2"
runner_environment: ""
extension-templates:
# NOTE: Because of how the text/template parsing works with / and . characters,
# we use " inside our template fragments which is why we use ' to wrap

# this API call leads back to the exact generated config used for this run
build-config-uri: '{{.api_url}}/pipeline/{{(index . "oidc.circleci.com/pipeline-id")}}/config'
# this API call leads back to the definition of the pipeline used for this run
# https://circleci.com/api/v2/projects/{project_id}/pipeline-definitions/{pipeline_definition_id}
build-signer-uri: '{{.api_url}}/projects/{{(index . "oidc.circleci.com/project-id")}}/pipeline-definitions/{{(index . "oidc.circleci.com/pipeline-definition-id")}}'
runner-environment: '{{if eq (index . "oidc.circleci.com/ssh-rerun") "true"}}ssh-rerun{{ else }}""{{end}}'
source-repository-ref: '{{index . "oidc.circleci.com/vcs-ref"}}'
source-repository-uri: '{{index . "oidc.circleci.com/vcs-origin"}}'
subject-alternative-name-template: '{{.api_url}}/projects/{{(index . "oidc.circleci.com/project-id")}}/pipeline-definitions/{{(index . "oidc.circleci.com/pipeline-definition-id")}}'
Loading