Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove depot/setup-action with.oidc #15632

Merged
merged 1 commit into from
Mar 19, 2024

Conversation

jacobwgillespie
Copy link
Contributor

This removes the with.oidc option from the depot/setup-action - the Depot CLI should now natively handle this for public PRs ✨

@jacobwgillespie jacobwgillespie requested a review from a team as a code owner March 19, 2024 16:04
@miketheman miketheman added developer experience Anything that improves the experience for Warehouse devs testing Test infrastructure and individual tests labels Mar 19, 2024
@miketheman
Copy link
Member

@jacobwgillespie Thanks!

Seeing these in this run's log:

Unable to exchange GitHub OIDC token for temporary Depot token: Error: Error message: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
Attempting to acquire open-source pull request OIDC token
Waiting for OIDC auth challenge 03d3a118-00f0-4d55-85fa-1766f0a63861
Waiting for OIDC auth challenge 03d3a118-00f0-4d55-85fa-1766f0a63861
Waiting for OIDC auth challenge 03d3a118-00f0-4d55-85fa-1766f0a63861
...

It still succeeds, but is this still trying to do something and times out?

@jacobwgillespie
Copy link
Contributor Author

Hey yeah those logs are somewhat expected (I need to silence the initial error) - the way OIDC works for external PR workflows is that a challenge token is printed to the logs then the OIDC issuer connects to the workflow log stream and verifies the token value is being printed.

The initial error can be ignored, I need to fix the action so it doesn't print it

@miketheman miketheman merged commit 4b94bfe into pypi:main Mar 19, 2024
17 checks passed
@miketheman
Copy link
Member

Thanks @jacobwgillespie ! I'm noticing it kinda spin on that step, and take ~3-4 minutes to continue - which drives up CI times. Is that also something that will be addressed soon?

@miketheman
Copy link
Member

Looks like this removal had other negative impact on other steps? https://github.com/pypi/warehouse/actions/runs/8346865483/job/22845432075

@di
Copy link
Member

di commented Mar 19, 2024

Looks like we're trying to pass the output of depot pull-token to the next job:

- name: Export Token
id: pull-token
run: echo "token=$(depot pull-token)" >> "$GITHUB_OUTPUT"

But it's empty now, causing this to fail:

image: registry.depot.dev/rltf7cln5v:${{ needs.build.outputs.buildId }}
credentials:
username: x-token
password: ${{ needs.build.outputs.token }}

@di
Copy link
Member

di commented Mar 19, 2024

Maybe only sometimes? Seems to have worked fine for #15631.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
developer experience Anything that improves the experience for Warehouse devs testing Test infrastructure and individual tests
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants