Repository navigation
Vendor hex_core v0.21.0 - #1283
Merged
Merged
Conversation
hex_core v0.21.0 only requests the CI job's OIDC token for the
`hexpm` audience and returns `{oidc_audience_not_allowed, Audience}`
when the API advertises another one. Describe that error instead of
raising FunctionClauseError in Hex.WorkloadIdentity.describe/2.
The workload_identity_audience config, overridden by HEX_WORKLOAD_IDENTITY_AUDIENCE, sets the audience Workload Identity requests the OIDC token for, `hexpm` by default, so Workload Identity works with an api_url that points to a Hex server using another audience. Add the changelog entries for hex_core v0.21.0, and say in the changelog and the mix hex.publish docs that an organization's write workload identities can publish the public packages it owns.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vendors hex_core v0.21.0 with
scripts/vendor_hex_core.sh.hex_core now only asks the CI provider for an OIDC token for the configured audience, and returns
{oidc_audience_not_allowed, Audience}when the API advertises another one (hexpm/hex_core#247).Hex.WorkloadIdentitydescribes that error, which raisedFunctionClauseErrorbefore. The newworkload_identity_audienceconfig, overridden byHEX_WORKLOAD_IDENTITY_AUDIENCE, sets the audience,hexpmby default, for anapi_urlthat points to a Hex server using another one.hex_core also renews a token and retries when the server answers 401 with
error="invalid_token", which hex.pm sends since hexpm/hexpm#2061 (hexpm/hex_core#244). It recognized onlyerror="token_expired"before, which hex.pm never sends. In Hex this refreshes themix hex.user authsession, and exchanges again a short-lived token from an organization key or Workload Identity.The changelog gets entries for both, and the Workload Identity entry and the
mix hex.publishdocs now say that an organization'swriteworkload identities with public packages publish the public packages it owns (hexpm/hexpm#2064).