Repository navigation
ci: bind deploy job to the production environment - #1185
Open
jdomeracki-coder wants to merge 1 commit into
Open
jdomeracki-coder wants to merge 1 commit into
jdomeracki-coder wants to merge 1 commit into
Conversation
Pins the deploy job's GitHub OIDC subject to repo:coder/registry:environment:production so the GCP side (coder/gcp projects/production/coder-registry-1) can trust that single subject instead of a pool-wide repository principalSet that matched any branch, PR, or workflow of this repo. The 'production' environment's deployment branch/tag policy (main + release/*/*/v* tags) then controls which refs may deploy. Part of the fix for coder/security-assessments#350. Requires: the 'production' environment must exist in repo settings with deployment branch/tag policies 'main' (branch) and 'release/*/*/v*' (tag) before the GCP-side binding change merges; this change itself is safe to merge first (the current principalSet binding matches any subject from this repo, including the environment subject).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part 1 of the fix for coder/security-assessments#350 (SEC: anyone with write access to this repo can assume the project-editor GCP service account).
Adds
environment: productionto thedeployjob in.github/workflows/deploy-registry.yaml. With the job bound to an environment, GitHub mints the OIDC token with:instead of a branch/tag subject. The companion GCP change (coder/gcp PR, part 2) pins the
registry-v2-github@coder-registry-1service account'sworkloadIdentityUserbinding to exactly that subject, replacing the current pool-wideattribute.repository/coder/registryprincipalSet that matches a token from any branch, PR workflow, or scheduled job in this repo.The environment's deployment branch/tag policy then becomes the control over which refs may deploy.
Prerequisite (manual, repo settings)
Before merging, create the
productionenvironment in this repo (Settings → Environments) with deployment branch/tag policies:mainrelease/*/*/v*release/<ns>/<name>/vX.Y.Z) — GitHub's*does not match/, so this matches exactly the 3-segment release tagsOptionally add required reviewers to the environment for human-in-the-loop production deploys (also mitigates #353).
If the environment does not exist when this merges, GitHub auto-creates an unprotected
productionenvironment on first run — deploys keep working, but the ref policy is not enforced until configured, so please create/configure it first.Rollout order
productionenvironment (above).roles/editor).Order matters only for step 3: merging the GCP change before this one would lock the deploy workflow out (fail-closed, no security impact).
Notes
id-token: writeis unchanged..github/is owned by @jdomeracki-coder per CODEOWNERS.Filed as part of the Glasswing security assessment (coder/security-assessments#347).