OIDC provider

[scubbo]

This adds support for a Github Actions compatible OIDC provider.

For more info, see:
https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect

It depends on a few changes in act and act_runner:
https://gitea.com/gitea/act_runner/pulls/272
https://gitea.com/gitea/act/pulls/73

---

The above is the summary of the original PR that this sprang from. It looks like that one (which has been open for nearly 2 years) has lost steam after the original contributor got frustrated with delays, so I'm hoping that opening a fresh PR will revitalize the effort.

To be extremely clear:

• All the content in this PR at the time it was opened was written by someone else, not me
• I have a reasonable understanding of both OIDC (as a user rather than an implementer/maintainer) and of GoLang (using both in my day job), but am by no means an expert in either. I'm taking this on because I'm very keen to see it move along (so that I can authenticate to Vault on a per-repo basis), not because I'm necessarily the right person for the job. I'll happily take guidance and learn as I go, but you should probably assume that I'll have to do some research before understanding any comments.

[scubbo]

I'm not sure if this file is actually needed - in the original PR there was just a small change to its logic, but it looks like the file has been entirely deleted in the main branch of the repo. I think it can be deleted entirely, but I'll keep it around until either a) I can get more confidence in that position, or b) someone more knowledgeable about the codebase can confirm that.

[wxiaoguang]

It has been moved in a recent PR. Maybe you could try to find when it is deleted. https://stackoverflow.com/questions/6839398/find-when-a-file-was-deleted-in-git

[scubbo]

Ah, thanks! Looks like it was moved to services/actions/task.go.

[scubbo]

Hmm - I'm getting error:

no required module provides package code.gitea.io/gitea/modules/context; to add it:
	go get code.gitea.io/gitea/modules/context

but when I run that command, I get

go: code.gitea.io/gitea/modules/context: no matching versions for query "upgrade"

I'm guessing that some names changed between the time this code was originally written and now. I'll keep poking around!

[wxiaoguang]

It is code.gitea.io/gitea/services/context now. services

[scubbo]

Note that building will still fail until this PR is merged, since it adds a RawPermissions struct-field that this depends on. Operating on the assumption that OP won't mind if I take that one over (and resolve conflicts), I'll do so now - since that one was already approved, hopefully it shouldn't take long to get the second version of it approved and merged!

EDIT: re-opened here.

[scubbo]

I re-opened the PRs on act and act_runner which are dependencies of this one. Hopefully 🤞🏻 those should be smooth to merge (since it looks like the originals were already approved), at which point I can iron out the rest of the build/lint failures. Thanks for the assistance/attention so far! 🙏🏻

[lunny]

This PR on act has been merged (though it looks like the test job failed to execute?), so I'll update this PR which will hopefully resolve some of the lint failures due to reliance on previously-absent code.

(The PR on act_runner is still outstanding, though, so probably not all failures will be resolved)

I restarted the CI.

[scubbo]

Hmm, I'm a little stumped by this last build failure - the original uses oauth2.SignToken, but no such function currently exists. I'll try to hunt down the commit where it was renamed/replaced.

EDIT: Ah, found it - in this commit, looks like we now need to use oauth2_provider.

[scubbo]

I suspect that these failing db-tests are going to be beyond my immediate capability to fix. In particular, I get different behaviour locally when running make test-sqlite - in the GitHub workflow runs, the failure is here; but in local reproduction, this testcase cannot be retrieved here.

I'll keep poking around to see if I can reproduce/understand/fix this failure; but this is probably the point where this PR would benefit from someone who knows the codebase better stepping in.