jwt: support both `CI_JOB_JWT` and id tokens (!83) · Merge requests · repos / releng / kokkuri · GitLab

How to register an account on GitLab. Due to spam, new accounts are locked until approved by an admin or the approver bot. Your GitLab account gets automatically approved within one hour if you are a member of Trusted Contributors in Gerrit, or a member of the Trusted-Contributors group in Phabricator and linked your Developer account to your Phabricator account. If none of these apply, you can file an unlock request to expedite access.

Support: mw:GitLab, how to host a project on GitLab, #wikimedia-gitlab on libera.chat, #GitLab on Phabricator.

🚨THIS IS A REPLICA🚨 -- You probably want to use the production gitlab, https://gitlab.wikimedia.org. Data on this instance is likely to be overwritten at short notice. Login with hardware 2FA key does not work, please use one-time passwords.

Jaime Nuche requested to merge support-multiple-jwt-types into main Aug 03, 2023

Since GitLab was upgraded recently to version 16, this change is a requisite for the pipeline of the following MR to pass: !73 (merged)

Without this change, the usage of an id token precludes the injection of the CI_JOB_JWT variable into the pipeline, which in turn causes the bootstrap-kokkuri-image job to fail. See also: https://docs.gitlab.com/ee/update/deprecations.html#old-versions-of-json-web-tokens-are-deprecated

Bug: T337474

Edited Aug 03, 2023 by Jaime Nuche