Skip to content

Harden CI: Artifactory OIDC, fork-aware workflows, composer.lock#253

Open
MichaelGHSeg wants to merge 3 commits into
masterfrom
ci/harden-build-publish
Open

Harden CI: Artifactory OIDC, fork-aware workflows, composer.lock#253
MichaelGHSeg wants to merge 3 commits into
masterfrom
ci/harden-build-publish

Conversation

@MichaelGHSeg

Copy link
Copy Markdown
Contributor

Summary

  • Add Artifactory OIDC composite action — exchanges GitHub OIDC token for short-lived Artifactory access token, configures Composer to resolve through `virtual-php-thirdparty`
  • Add `ci.yml` — replaces `tests.yml`, fork-aware runner selection, PHP 8.1–8.4 matrix, `composer install --no-scripts`, SHA-pinned actions
  • Update `e2e-tests.yml` — remove `E2E_TESTS_TOKEN` (sdk-e2e-tests going public), fork-aware
  • Commit `composer.lock` (removed from `.gitignore`)

Notes

  • No deploy workflow needed — Packagist publishes automatically from git tags
  • Old `tests.yml` can be deleted once `ci.yml` is validated

Test plan

  • CI runs on this PR
  • Artifactory OIDC exchange succeeds on same-repo CI
  • Before merging: set `ARTIFACTORY_URL` repository variable

- Add Artifactory OIDC composite action (configures Composer to use virtual-php-thirdparty)
- Add ci.yml: fork-aware, PHP 8.1-8.4 matrix, --no-scripts, SHA-pinned actions
- Update e2e-tests.yml: remove E2E_TESTS_TOKEN, fork-aware
- Commit composer.lock (removed from .gitignore)
Comment thread .github/workflows/ci.yml Outdated
Comment thread .github/workflows/ci.yml Outdated
didiergarcia
didiergarcia previously approved these changes Jul 10, 2026
Rewrite composite action to use single-script pattern matching
analytics-python: audience=${ARTIFACTORY_URL}, provider_name=
github-actions-segmentio, and add JWT claim logging for debugging.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants