Repository navigation
fix: oidc issues and gcp support - #23
Merged
Merged
Conversation
…e in try/catch - Throw instead of process.exit(1) for unsupported cloud providers - Wrap fs.writeFile in try/catch with descriptive error message - Remove p.cancel calls in favor of thrown errors Tests: add coverage for GCP/unsupported provider throws and writeFile failure
…ation - Replace all 4 process.exit(0) cancel paths with thrown errors - Add repo format validation (must match owner/repo) - Use cancelSymbol for proper isCancel mocking Tests: add cancel coverage for CI provider, repo, and branch prompts; add repo format validation tests
…ub provider - Add SessionToken presence check before KMS client creation - Validate audience is non-empty before GitHub OIDC token fetch Tests: add missing SessionToken rejection test; add empty/whitespace audience rejection tests
… to templates - Add azuread_application resource to Azure template (was referencing non-existent resource) - Add Terraform output blocks for AWS (role ARN) and Azure (application object ID) Tests: add output block assertions for both AWS and Azure templates; add azuread_application resource presence test
- New generateGcpTemplate() with google_iam_workload_identity_pool, google_iam_workload_identity_pool_provider, and google_service_account_iam_member resources - Supports GitHub Actions and GitLab CI providers - Environment mapping (prod→main, qa→release/*) Tests: 7 tests covering GitHub, GitLab, env mapping, pool resource, service account binding, and unsupported CI
LutfiGarzon
changed the title
… template The GCP template referenced google_service_account.vault.name and var.project_id without creating them. Now self-contained like AWS/Azure. Tests: add assertions for variable and service_account presence
- Add thumbprint rotation warning comments to AWS template - Fix Azure GitLab audience to api://AzureADTokenExchange (was https://gitlab.com) - Add missing azuread_service_principal to Azure template - Fix AWS STSClient to use explicit empty credentials (AssumeRoleWithWebIdentity is anonymous) - Document vault ci AWS-only limitation in ci.ts - Expand GCP attribute_mapping with repository/project_path and actor/ref - Replace deprecated Buffer.from() with Uint8Array in AWS provider - Add env suffix to GCP service_account account_id to prevent collisions Tests: 156 passing
…eprecation warning - Remove env-based branch overrides (prod→main, qa→release/*); user branch is always respected - Remove wildcard ban from TUI branch validator - Add file-exists check with p.confirm prompt before overwriting .tf - Add --force flag to skip overwrite prompt - Add CI_JOB_JWT_V2 deprecation warning in GitLab provider Tests: 159 passing
…terface - Define CloudKmsProvider interface (name + decrypt contract) - AwsKmsProvider adapter wrapping existing decryptWithAwsKms - AzureKeyVaultProvider via REST API (client_assertion grant + Key Vault decrypt) - GcpKmsProvider via REST API (STS token exchange + Cloud KMS decrypt) - Refactor ci.ts to detect cloud provider from env vars and route to correct provider - Each cloud provider gets the correct OIDC audience for JWT requests - Backward compatible: existing VAULT_AWS_ROLE_ARN env vars still work Tests: 171 passing, 33 test files
- Fix double blank line in Azure template concatenation - Add terraform fmt - integration tests for all three templates - Tests gracefully skip if terraform binary is not installed Tests: 174 passing
…and structural validation - VAULT_CLOUD_PROVIDER env var to explicitly select cloud when multiple are configured - Error if multiple cloud vars set without VAULT_CLOUD_PROVIDER - README: CI runtime env var docs for AWS, Azure, GCP with GitLab audience note - Expanded vault ci --help with cloud env var reference - Error-case tests for missing Azure/GCP required env vars - Template structural validation tests for dangling references Tests: 182 passing
…larification - vault oidc --dry-run: preview template to stdout without writing - vault ci --check: verify OIDC→KMS chain without vault file or command execution - README: GitHub Actions workflow example with id-token: write - README: clarify KMS key is user-provided (templates handle trust, not encryption) - Test for overwrite cancel (p.isCancel branch) Tests: 186 passing
|
🎉 This PR is included in version 1.4.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The OIDC feature had no design review coverage and accumulated several operational,
UX, and architectural gaps since its initial implementation. Providers were missing
prerequisites, templates were incomplete, error handling was fragile, and there was no
multi-cloud runtime support beyond AWS. This PR brings the feature to
production-readiness with full test coverage (186 tests, 33 files, 100% OIDC feature
coverage).
What
🔴 Operational fixes
that thumbprints may need rotation
https://gitlab.comtoapi://AzureADTokenExchangewith a note for GitLab CI configazuread_service_principal— Azure template now creates the SPalongside the application
anonymous
AssumeRoleWithWebIdentitycallattribute_mapping— expanded withattribute.repository,attribute.actor(GitHub) andattribute.project_path,attribute.ref(GitLab)account_idnow includes env suffix toprevent conflicts across environments
🟢 Minor fixes
Buffer.from()→Uint8Arrayin AWS providerterraform fmt— integration test validates all threetemplates against the
terraformbinary🟡 Design improvements
--env prod/--env qano longer silently changeyour branch input
release/*and other wildcard branches are now allowedvault oidcprompts before replacing existing.tffiles;--forceskips it--dry-run— preview template to stdout without writing🚀 Multi-cloud runtime (vault ci)
CloudKmsProviderinterface — contract-based decryption:AwsKmsProvider,AzureKeyVaultProvider,GcpKmsProviderclient_assertiongrant + Key Vault decryptVAULT_CLOUD_PROVIDER— explicit override; errors if multiple cloud env varsare set without it
vault ci --check— verify OIDC→KMS chain without vault file or commandexecution
CI_JOB_JWT_V2deprecation — documented fallback with warning📚 Documentation
id-token: writevault ci --helpexpanded with cloud env var reference