Use Forgejo OIDC for review requests
What the developer wrote
Authored by Elias Rohrer
Use Forgejo OIDC for review requests
Request a local Authorized Integration JWT in the reviewer workflow.
Use bearer authorization for the reviewer request API call.
This avoids a long-lived user token.
The workflow still gets the missing reviewer-request capability.
Co-Authored-By: HAL 9000
What changed, and why it matters
This commit changes the project's automated reviewer-assignment workflow to stop using a long-lived secret token and instead request a short-lived authentication token from the Forgejo CI service. This is a security-hardening improvement: it reduces the risk that a stolen or leaked long-lived token could be misused. There is no indication of an active vulnerability being fixed, and the change itself does not introduce obvious new weaknesses.
No immediate action required. Verify that the Forgejo instance supports Authorized Integration OIDC tokens and that the workflow's `id-token: write` permission is the minimum required. Consider rotating and removing the old `FORGEJO_TOKEN` secret if it is no longer used elsewhere.
Security signals we found
Removal of long-lived repository secret from CI workflow
Adoption of OIDC-based short-lived token for API authorization
Workflow runs in pull_request_target context with no code checkout
Explicit masking of the fetched JWT in workflow logs
Comment explicitly states the workflow remains safe because it only makes an API call
Evidence from the diff
The .forgejo/workflows/assign-reviewer.yml workflow is updated to enable OpenID Connect (enable-openid-connect: true) and request an Authorized Integration JWT via the Forgejo Actions ID token endpoint. The API call to assign a reviewer now uses Authorization: bearer ${{ steps.jwt.outputs.jwt }} instead of a repository secret FORGEJO_TOKEN. The workflow variables are also migrated from github.* to forgejo.* context variables. The job is granted id-token: write permission, which is required to obtain the OIDC token. The workflow still runs in the safe pull_request_target context and does not check out or execute PR code.
Changed components
.forgejo/workflows/assign-reviewer.ymlInspect captured patch +17 / −8
diff --git a/.forgejo/workflows/assign-reviewer.yml b/.forgejo/workflows/assign-reviewer.yml
index f4e4f86..f9dee10 100644
--- a/.forgejo/workflows/assign-reviewer.yml
+++ b/.forgejo/workflows/assign-reviewer.yml
@@ -8,25 +8,34 @@ on:
pull_request_target:
types: [opened]
+enable-openid-connect: true
+
jobs:
assign:
runs-on: debian-trixie
+ permissions:
+ id-token: write
steps:
+ - name: Fetch Authorized Integration token
+ id: jwt
+ run: |
+ set -eu
+ jwt="$(curl -fsS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r '.value')"
+ echo "::add-mask::$jwt"
+ echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"
- name: Request review from a random developer
# This never checks out or runs any PR code -- it only makes an API
- # call -- so running in the base-repo context (pull_request_target,
- # which is what grants the token write access even for fork PRs) is safe.
+ # call with a local Authorized Integration token.
env:
- API: ${{ github.server_url }}/api/v1
- REPO: ${{ github.repository }}
- PR: ${{ github.event.pull_request.number }}
- AUTHOR: ${{ github.event.pull_request.user.login }}
- FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+ API: ${{ forgejo.server_url }}/api/v1
+ REPO: ${{ forgejo.event.repository.full_name }}
+ PR: ${{ forgejo.event.pull_request.number }}
+ AUTHOR: ${{ forgejo.event.pull_request.user.login }}
# Space-separated pool of candidate reviewers.
REVIEWERS: "matt val wpaulino joost_spiral jkczyz benthecarman tankyleo tnull"
run: |
set -eu
- AUTH="Authorization: token ${FORGEJO_TOKEN}"
+ AUTH="Authorization: bearer ${{ steps.jwt.outputs.jwt }}"
# Build the candidate pool, excluding the PR author.
POOL=""
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.