ci: roll out OIDC review workflow #4

Merged

jercik merged 1 commit from ci/oidc-review-rollout into main 2026-07-31 05:31:11 +00:00

Conversation 0 Commits 1 Files changed 14 +3581 -609

jercik commented 2026-07-30 17:14:04 +00:00

Owner

Copy link

Regenerated with j4k-align v1.100.5 --fix-workflows (the first release carrying align#167's dependency-closure fix).

pr-review.yml now mints a per-run Actions OIDC token and exchanges it at recipe.axkit.dev via axrecipe forgejo-actions exchange, replacing every reference to the static org secret AXRECIPE_API_KEY — whose stale hand-managed value has been failing all review jobs in this org with HTTP 401 since the last root rotation. The declared dependency closure lands in the same pass: the .forgejo/actions/post-review/ local action (8 files, byte-identical to the v1.100.5 templates) and .node-version. checks.yml, commit-msg.yml, dedupe-check.yml, and release.yml are reconciled to current templates; release.yml remains parameterized for the j4k-oss npm registry (NPM_PUBLISH_OSS_AUDIENCE).

The repo is already in the OIDC allowlist (repositoryId: 35, cluster main since 2026-07-29), so no service-side change is needed.

Expected red checks: this PR's own PR Review contexts run the legacy workflow from base main and fail with the known 401 by construction; they cannot pass before this lands. The OIDC issuer trusts workflowRef: refs/heads/main only — validate post-merge with a main-branch workflow_dispatch, not from this branch.

Regenerated with `j4k-align` v1.100.5 `--fix-workflows` (the first release carrying align#167's dependency-closure fix). `pr-review.yml` now mints a per-run Actions OIDC token and exchanges it at `recipe.axkit.dev` via `axrecipe forgejo-actions exchange`, replacing every reference to the static org secret `AXRECIPE_API_KEY` — whose stale hand-managed value has been failing all review jobs in this org with HTTP 401 since the last root rotation. The declared dependency closure lands in the same pass: the `.forgejo/actions/post-review/` local action (8 files, byte-identical to the v1.100.5 templates) and `.node-version`. `checks.yml`, `commit-msg.yml`, `dedupe-check.yml`, and `release.yml` are reconciled to current templates; `release.yml` remains parameterized for the `j4k-oss` npm registry (`NPM_PUBLISH_OSS_AUDIENCE`). The repo is already in the OIDC allowlist (`repositoryId: 35`, cluster main since 2026-07-29), so no service-side change is needed. **Expected red checks:** this PR's own PR Review contexts run the legacy workflow from base `main` and fail with the known 401 by construction; they cannot pass before this lands. The OIDC issuer trusts `workflowRef: refs/heads/main` only — validate post-merge with a main-branch `workflow_dispatch`, not from this branch.

jercik added 1 commit 2026-07-30 17:14:04 +00:00

ci: roll out OIDC review workflow ... 60e247efd2

Regenerated with j4k-align v1.100.5 (--fix-workflows). pr-review.yml now
mints a per-run Actions OIDC token and exchanges it at recipe.axkit.dev
instead of reading the static org secret AXRECIPE_API_KEY, whose stale
value has been failing every review job with HTTP 401. The managed
dependency closure lands alongside: the post-review local action and
.node-version. checks, commit-msg, dedupe-check, and release are
reconciled to the current templates in the same pass.

This PR's own PR Review checks run the legacy workflow from base main
and fail with the known 401 by construction; they cannot go green
before this lands.

jercik merged commit 2067bdefe2 into main 2026-07-31 05:31:11 +00:00

jercik deleted branch ci/oidc-review-rollout 2026-07-31 05:31:11 +00:00

jercik referenced this pull request from a commit 2026-07-31 05:31:12 +00:00

ci: roll out OIDC review workflow (#4)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

j4k-oss/tropkod-client!4

No description provided.