Fix sequential OIDC authentication with exported tokens - #47
Merged
cloudsmith-iduffy merged 2 commits intoSep 10, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes sequential OIDC authentication when exported tokens are inherited between action invocations.
Changes:
- Isolates inherited API keys during OIDC resolution.
- Adds Bash and PowerShell regression tests.
- Documents and integrates tests across the CI matrix.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
scripts/test-setup.sh |
Adds Bash regression coverage. |
scripts/test-setup.ps1 |
Adds PowerShell regression coverage. |
scripts/setup.sh |
Isolates inherited API keys during OIDC resolution. |
scripts/setup.ps1 |
Temporarily clears and restores inherited API keys. |
CONTRIBUTION.md |
Documents local regression test commands. |
.github/workflows/test.yml |
Runs linting and platform-specific setup tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
cloudsmith-iduffy
force-pushed
the
cloudsmith-iduffy-sequential-oidc-authentication
branch
from
September 10, 2026 10:52
b1ed6c2 to
c48c105
Compare
tigh-latte
approved these changes
Sep 10, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Running the action twice in one job with
export-auth-token: truecould reuse the first service account's token even when the second invocation requested a differentoidc-service-slug. The inheritedCLOUDSMITH_API_KEYtook precedence over OIDC, preventing workflows from switching from a pull-only account to a push-capable account.Both wrappers now hide inherited API keys from the internal credential-helper command when OIDC inputs are supplied without an explicit
api-key. Bash scopes the unset to a subshell; PowerShell restores the environment infinally. The resolved token is then validated, masked, and exported for subsequent steps as before.Explicit
api-keyprecedence and input validation are unchanged. This does not change CLI credential-provider precedence or behavior when token export is disabled.