Skip to content

Enhanced debugging for OIDC token exchange #2443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Lanaparezanin wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −3
Open

Enhanced debugging for OIDC token exchange #2443

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions packages/core/src/oidc-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,23 @@ export class OidcClient {
const token = process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN']
if (!token) {
throw new Error(
'Unable to get ACTIONS_ID_TOKEN_REQUEST_TOKEN env variable'
'Unable to get ACTIONS_ID_TOKEN_REQUEST_TOKEN env variable. Ensure your workflow has:\n' +
' permissions:\n' +
' id-token: write'
)
Comment on lines 31 to 35
}
setSecret(token)
return token
}

private static getIDTokenUrl(): string {
const runtimeUrl = process.env['ACTIONS_ID_TOKEN_REQUEST_URL']
if (!runtimeUrl) {
throw new Error('Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable')
throw new Error(
'Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable. Ensure your workflow has:\n' +
' permissions:\n' +
' id-token: write'
)
Comment on lines 43 to +48
}
return runtimeUrl
}
Expand All @@ -58,7 +65,10 @@ export class OidcClient {

const id_token = res.result?.value
if (!id_token) {
throw new Error('Response json body do not have ID Token field')
throw new Error(
`Response json body does not have ID Token field (HTTP ${res.statusCode}). ` +
'Verify that the audience is correct and that the token service URL is reachable.'
)
Comment on lines +68 to +71
}
return id_token
}
Expand Down