enhance(actions): add OIDC workload identity support

[0xMax42]

Adds OpenID Connect workload identity to Gitea Actions: jobs declaring id-token: write can request short-lived tokens to authenticate to cloud providers and other services without stored secrets. Tokens follow GitHub's format, so clients like @actions/core and existing trust policies carry over.

• Issuer at /api/actions/oidc with discovery and JWKS, signed with a dedicated RS256 key
• GitHub's claims, including workflow_ref, job_workflow_ref and the immutable repo:owner@id/repo@id:ref:... subject
• id-token: write or write-all grant it, default permissions and fork pull requests never get it, owner and repository maximum permissions can disable it
• Reusable workflows record the fully qualified ref they were loaded from
• github.ref_type is branch for pull request runs, like on GitHub

Fixes #26383
Fixes #33681

Docs: https://gitea.com/gitea/docs/pulls/526

Before:

After:

Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5

[0xMax42]

Manual validation note

In addition to the automated test suite, which is currently passing, I have
manually tested the current implementation on a Gitea instance.

The following scenarios were verified:

• regular workflow with id-token: write → OIDC runtime context is available
  and a token can be minted successfully
• regular workflow with id-token: none → OIDC runtime context is absent
• regular workflow with id-token: read → OIDC runtime context is absent
• repository-level maximum permission disabling OIDC → runtime context is
  absent even when the workflow requests id-token: write
• re-enabling OIDC at repository level → token issuance works again
• cross-repository reusable workflow with id-token: write → token issuance
  succeeds and root/reusable workflow provenance is reported separately and
  correctly
• reusable workflow where the caller has id-token: none while the called
  workflow requests id-token: write → OIDC runtime context is absent, i.e.
  the called workflow cannot elevate the caller's permission

The positive end-to-end test also verified the issued token using only the
public OIDC discovery document and JWKS, including signature, issuer, audience,
lifetime, repository/ref/SHA claims, and workflow provenance.

This is mainly a note for tracking the current Draft validation state; I still
intend to perform my own complete code/security review before marking the PR
ready for review.

[silverwind]

Make sure your agent has read AGENTS.md and followed it exactly. Based on this long PR description, I see that it didn't read it. Please re-review the whole work under the AGENTS.md constraints.

[0xMax42]

Make sure your agent has read AGENTS.md and followed it exactly. Based on this long PR description, I see that it didn't read it. Please re-review the whole work under the AGENTS.md constraints.

Sorry! I’ve now amended the pull request description in line with the guidelines in AGENTS.md, and I’ve added the screenshots I’d already prepared.

I’ll check the entire change once more against the guidelines in AGENTS.md before removing the pull request from draft status.

[silverwind]

Thanks, yes that's a more managable size now :)

[0xMax42]

While reviewing/testing this, I noticed an unrelated existing issue in the OAuth2 JWT signing-key setup: auto-generated ECDSA keys always use P-256, even when ES384 or ES512 is configured. This appears to make those algorithms fail when using an automatically generated key.

I don't think this belongs in this PR. Would you prefer a separate issue for it? I can open one later and look at it independently.

[0xMax42]

I've now completed my own review of the implementation and tests. The remaining piece is documentation, which I'll add separately.

In the meantime, feel free to take a look already — feedback and comments are very welcome.

[0xMax42]

Also verified that the Gitea Actions runner masks ACTIONS_ID_TOKEN_REQUEST_TOKEN in job logs as expected, including when environment variables are printed directly.

[Copilot]

Copilot review overview

🟡 Changes recommended

Cancelling-task issuance, optional key initialization, and migrated schedules currently have lifecycle and reliability defects.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Prevent optional signing-key initialization from terminating the process · New
• Resolve workflow paths for migrated action schedules · New
• Permit OIDC authentication during task cancellation cleanup · New
• Allow OIDC tokens for tasks in cancelling state · New

What changed in this PR

Adds OIDC workload identities to Gitea Actions, including permission enforcement, provenance claims, token endpoints, configuration UI, and tests.

Changes:

• Adds OIDC discovery, JWKS, and token issuance endpoints.
• Tracks workflow provenance and enforces effective id-token permissions.
• Adds configuration UI, migration, and automated coverage.

File	Description
tests/​integration/​actions_trigger_test.go	Verifies triggered-run workflow paths.
tests/​integration/​actions_scoped_workflow_test.go	Verifies scoped workflow paths.
tests/​integration/​actions_schedule_test.go	Verifies scheduled workflow paths.
tests/​integration/​actions_oidc_test.go	Tests the complete OIDC flow.
tests/​integration/​actions_concurrency_test.go	Checks scheduled concurrency provenance.
templates/​shared/​actions/​permissions_table.tmpl	Adds the ID-token permission control.
services/​actions/​workflow.go	Records dispatched workflow paths.
services/​actions/​task.go	Exposes OIDC request context to runners.
services/​actions/​schedule_tasks.go	Propagates scheduled workflow paths.
services/​actions/​permission_parser.go	Parses id-token permissions.
services/​actions/​permission_parser_test.go	Tests permission parsing.
services/​actions/​oidc.go	Implements OIDC authorization and claims.
services/​actions/​oidc_test.go	Tests OIDC services and claims.
services/​actions/​notifier_helper.go	Records detected workflow paths.
services/​actions/​init.go	Initializes OIDC signing support.
services/​actions/​auth.go	Restricts runtime JWTs to HS256.
services/​actions/​auth_test.go	Tests JWT algorithm rejection.
routers/​web/​shared/​actions/​general.go	Parses ID-token settings.
routers/​api/​actions/​oidc.go	Implements OIDC HTTP handlers.
routers/​api/​actions/​actions.go	Registers OIDC routes.
options/​locale/​locale_en-US.json	Adds OIDC permission labels.
modules/​actions/​workflows.go	Captures detected workflow paths.
modules/​actions/​scoped_workflows.go	Captures scoped workflow paths.
models/​repo/​repo_unit_test.go	Tests ID-token defaults and limits.
models/​repo/​repo_unit_actions.go	Extends token permission storage.
models/​actions/​utils.go	Copies schedule workflow provenance.
models/​actions/​token_permissions.go	Clamps reusable-workflow permissions.
models/​actions/​token_permissions_test.go	Tests effective OIDC permissions.
models/​actions/​schedule.go	Stores scheduled workflow paths.
models/​actions/​run.go	Stores run workflow paths.
models/​actions/​config.go	Adds owner-level OIDC limits.
modelmigration/​v28/​v353.go	Adds workflow-path columns.
modelmigration/​v28/​v353_test.go	Tests the schema migration.
modelmigration/​migrations.go	Registers migration 353.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[silverwind]

Reworked this on top of main, with GitHub compatibility as the priority:

1. Tokens match GitHub's format: the immutable repo:owner@id/repo@id:ref:... subject (:pull_request only for pull_request), a string aud, workflow as the workflow name, and job_workflow_ref/job_workflow_sha on every job
2. Reusable workflows record the fully qualified ref they were loaded from, so a same-named tag can't pose as a protected branch and the claim stays stable when the branch moves (migration in v29)
3. Dedicated RS256 signing key created on first use instead of the OAuth2 provider key, no more fatal startup path
4. Separate ID token request token, so the runtime token that runners also send to cache servers can't mint OIDC tokens
5. Running and cancelling tasks can request tokens
6. The workflow directory is derived from the recorded commit, dropping the workflow_path columns and the migrated schedule gap
7. Dropped the reusable workflow permission walk (children are already clamped at expansion) and the HS256 narrowing
8. github.ref_type is branch for pull request runs, like on GitHub
9. Discovery advertises claims_supported and scopes_supported
10. Tests reduced to one integration test plus focused unit tests

The docs in https://gitea.com/gitea/docs/pulls/526 are updated to match.

Written by Claude Code (claude-opus-5-5)

[silverwind]

Cut out about 1k lines from the PR while fixing the issues above, migration is moved to v29, pr description updated and shortened.