fix(auth): resolve JWKS URL from the OIDC discovery document - #254
Merged
Conversation
An enterprise that customizes its issuer value gets tokens issued by `https://token.actions.githubusercontent.com/<enterpriseSlug>` while the JWKS stays at the root host, so deriving the JWKS URL as `{issuer}/.well-known/jwks` 404s and every token fails verification with `401 Invalid token`. Read `jwks_uri` from `{issuer}/.well-known/openid-configuration` instead, once and cached for the process. If discovery fails, log a warning and fall back to the derived URL — uncached, so an outage can't pin the process to a URL that may be wrong — which keeps GHES deployments working as before. `ACTIONS_TOKEN_JWKS_URL` overrides both. Fixes #253
LouisHaftmann
force-pushed
the
fix/jwks-oidc-discovery
branch
from
July 29, 2026 06:44
10f56c4 to
b2dbf48
Compare
Both reader-lease cleanup tests give their `vi.waitFor` the full 5s default test timeout, leaving nothing for the surrounding storage and database work, so they time out on the slower driver combinations (seen on gcs + mysql on `dev` as well). Give those two tests an explicit 30s timeout.
Merge completion locks `merge_leases` then `storage_locations`, while the cleanup tasks lock `storage_locations` first, so mysql can pick the merge as a deadlock victim. The `catch` then treated that transient failure as a failed merge and reset `mergedAt`/`mergeStartedAt` to null — discarding a merge whose `merged` object was already written, and leaving its parts undeletable until some later download merged the location again. Retry the transaction instead (up to three attempts, re-checking the merge lease fence each time), and rethrow anything that isn't a lock conflict. Observed as a flaky `cleanup-lifecycle` failure on the mysql CI jobs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #253
Problem
When an enterprise customizes its issuer value, runner tokens carry
iss: https://token.actions.githubusercontent.com/<enterpriseSlug>— but the JWKS stays at the root host. We derived the JWKS URL as{issuer}/.well-known/jwks, which 404s, so every request failed with401 Invalid token.Verified against the live endpoints:
GET https://token.actions.githubusercontent.com/<slug>/.well-known/openid-configuration→jwks_uri: "https://token.actions.githubusercontent.com/.well-known/jwks"(root host, for every slug tried)GET https://token.actions.githubusercontent.com/<slug>/.well-known/jwks→ 404, matching the reporter'sExpected 200 OK from the JSON Web Key Set HTTP responseChange
jwks_urifrom the issuer's OIDC discovery document instead of deriving it. Resolved lazily on the first token verification and cached for the process.ACTIONS_TOKEN_JWKS_URLskips discovery entirely, for deployments served by neither path.isscomparison now uses the trailing-slash-stripped issuer, so a pasted.../octocat-inc/no longer fails the issuer check.