Repository: sigstore/fulcio
Pull request #1773 (2024-08-19 02:15:18)

Bump google.golang.org/api from 0.191.0 to 0.192.0
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.191.0 to 0.192.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p>
<blockquote>
<h2>v0.192.0</h2>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.191.0...v0.192.0">0.192.0</a> (2024-08-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2725">#2725</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b2c7c055546c29cdf5e58cc6d7269ec87786badc">b2c7c05</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2727">#2727</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36e3fa714646166856687bb3ecf36026aab12707">36e3fa7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2728">#2728</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/97c7f2e7448b986635cabf0e1b5e26c5cc12a2d8">97c7f2e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2729">#2729</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a0ed1f3232e11c588e10666c8b3bde4472d7574f">a0ed1f3</a>)</li>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2730">#2730</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/2b4e9f483c30b271a6796997d7855d9d4f362604">2b4e9f4</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>internal/cba:</strong> Update credsNewAuth path to use nil oauth2 client (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2731">#2731</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b4575826c2262395659ab58cb3c7ecae991758c0">b457582</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.191.0...v0.192.0">0.192.0</a> (2024-08-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2725">#2725</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b2c7c055546c29cdf5e58cc6d7269ec87786badc">b2c7c05</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2727">#2727</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36e3fa714646166856687bb3ecf36026aab12707">36e3fa7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2728">#2728</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/97c7f2e7448b986635cabf0e1b5e26c5cc12a2d8">97c7f2e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2729">#2729</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a0ed1f3232e11c588e10666c8b3bde4472d7574f">a0ed1f3</a>)</li>
<li>Move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2730">#2730</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/2b4e9f483c30b271a6796997d7855d9d4f362604">2b4e9f4</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>internal/cba:</strong> Update credsNewAuth path to use nil oauth2 client (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2731">#2731</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b4575826c2262395659ab58cb3c7ecae991758c0">b457582</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/c616f4713dfc3bc21ed685bc442f6f63013224ce"><code>c616f47</code></a> chore(main): release 0.192.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2726">#2726</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/b4575826c2262395659ab58cb3c7ecae991758c0"><code>b457582</code></a> fix(internal/cba): Update credsNewAuth path to use nil oauth2 client (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2731">#2731</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/2b4e9f483c30b271a6796997d7855d9d4f362604"><code>2b4e9f4</code></a> feat: move storage, bigquery, and compute to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2730">#2730</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/a0ed1f3232e11c588e10666c8b3bde4472d7574f"><code>a0ed1f3</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2729">#2729</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/97c7f2e7448b986635cabf0e1b5e26c5cc12a2d8"><code>97c7f2e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2728">#2728</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/36e3fa714646166856687bb3ecf36026aab12707"><code>36e3fa7</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2727">#2727</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/b2c7c055546c29cdf5e58cc6d7269ec87786badc"><code>b2c7c05</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2725">#2725</a>)</li>
<li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.191.0...v0.192.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.191.0&new-version=0.192.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/go.mod b/go.mod
index 1a340ba..cb4895e 100644
--- a/go.mod
+++ b/go.mod
@@ -37,7 +37,7 @@ require (
 	github.com/spiffe/go-spiffe/v2 v2.3.0
 	go.step.sm/crypto v0.51.1
 	go.uber.org/zap v1.27.0
-	google.golang.org/api v0.191.0
+	google.golang.org/api v0.192.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
@@ -47,7 +47,7 @@ require (
 
 require (
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.8.0 // indirect
+	cloud.google.com/go/auth v0.8.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.3 // indirect
 	cloud.google.com/go/compute/metadata v0.5.0 // indirect
 	cloud.google.com/go/iam v1.1.12 // indirect
diff --git a/go.sum b/go.sum
index 1b04ec5..7464822 100644
--- a/go.sum
+++ b/go.sum
@@ -5,8 +5,8 @@ chainguard.dev/sdk v0.1.23/go.mod h1:TojPLtaHmy1TThjHjvPQbwKRDCusBPpQWSBZ2EkQFFk
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.8.0 h1:y8jUJLl/Fg+qNBWxP/Hox2ezJvjkrPb952PC1p0G6A4=
-cloud.google.com/go/auth v0.8.0/go.mod h1:qGVp/Y3kDRSDZ5gFD/XPUfYQ9xW1iI7q8RIRoCyBbJc=
+cloud.google.com/go/auth v0.8.1 h1:QZW9FjC5lZzN864p13YxvAtGUlQ+KgRL+8Sg45Z6vxo=
+cloud.google.com/go/auth v0.8.1/go.mod h1:qGVp/Y3kDRSDZ5gFD/XPUfYQ9xW1iI7q8RIRoCyBbJc=
 cloud.google.com/go/auth/oauth2adapt v0.2.3 h1:MlxF+Pd3OmSudg/b1yZ5lJwoXCEaeedAguodky1PcKI=
 cloud.google.com/go/auth/oauth2adapt v0.2.3/go.mod h1:tMQXOfZzFuNuUxOypHlQEXgdfX5cuhwU+ffUuXRJE8I=
 cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
@@ -490,8 +490,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.191.0 h1:cJcF09Z+4HAB2t5qTQM1ZtfL/PemsLFkcFG67qq2afk=
-google.golang.org/api v0.191.0/go.mod h1:tD5dsFGxFza0hnQveGfVk9QQYKcfp+VzgRqyXFxE0+E=
+google.golang.org/api v0.192.0 h1:PljqpNAfZaaSpS+TnANfnNAXKdzHM/B9bKhwRlo7JP0=
+google.golang.org/api v0.192.0/go.mod h1:9VcphjvAxPKLmSxVSzPlSRXy/5ARMEw5bf58WoVXafQ=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
diff --git a/pkg/identity/github/principal.go b/pkg/identity/github/principal.go
index 5eaa74a..da9e444 100644
--- a/pkg/identity/github/principal.go
+++ b/pkg/identity/github/principal.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"crypto/x509"
 	"errors"
+	"fmt"
 	"net/url"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -105,6 +106,7 @@ func WorkflowPrincipalFromIDToken(_ context.Context, token *oidc.IDToken) (ident
 		WorkflowSha          string `json:"workflow_sha"`
 		RunID                string `json:"run_id"`
 		RunAttempt           string `json:"run_attempt"`
+		Enterprise           string `json:"enterprise"`
 	}
 	if err := token.Claims(&claims); err != nil {
 		return nil, err
@@ -159,10 +161,16 @@ func WorkflowPrincipalFromIDToken(_ context.Context, token *oidc.IDToken) (ident
 		return nil, errors.New("missing run_attempt claim in ID token")
 	}
 
+	baseURL := `https://github.com/`
+
+	if claims.Enterprise != "" {
+		baseURL = fmt.Sprintf("https://%s.ghe.com/", claims.Enterprise)
+	}
+
 	return &workflowPrincipal{
 		subject:              token.Subject,
 		issuer:               token.Issuer,
-		url:                  `https://github.com/`,
+		url:                  baseURL,
 		sha:                  claims.Sha,
 		eventName:            claims.EventName,
 		repository:           claims.Repository,


Test patch:
diff --git a/pkg/identity/github/principal_test.go b/pkg/identity/github/principal_test.go
index 3b1d01b..7368fef 100644
--- a/pkg/identity/github/principal_test.go
+++ b/pkg/identity/github/principal_test.go
@@ -84,6 +84,53 @@ func TestWorkflowPrincipalFromIDToken(t *testing.T) {
 			},
 			WantErr: false,
 		},
+		`Valid token, custom base url authenticates with correct claims`: {
+			Claims: map[string]interface{}{
+				"aud":                   "sigstore",
+				"event_name":            "push",
+				"exp":                   0,
+				"iss":                   "https://token.actions.githubusercontent.com",
+				"job_workflow_ref":      "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+				"job_workflow_sha":      "example-sha",
+				"ref":                   "refs/heads/main",
+				"repository":            "sigstore/fulcio",
+				"repository_id":         "12345",
+				"repository_owner":      "username",
+				"repository_owner_id":   "345",
+				"repository_visibility": "public",
+				"run_attempt":           "1",
+				"run_id":                "42",
+				"runner_environment":    "cloud-hosted",
+				"sha":                   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+				"sub":                   "repo:sigstore/fulcio:ref:refs/heads/main",
+				"workflow":              "foo",
+				"workflow_ref":          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+				"workflow_sha":          "example-sha-other",
+				"enterprise":            "test",
+			},
+			ExpectPrincipal: workflowPrincipal{
+				issuer:               "https://token.actions.githubusercontent.com",
+				subject:              "repo:sigstore/fulcio:ref:refs/heads/main",
+				url:                  "https://test.ghe.com/",
+				jobWorkflowRef:       "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+				sha:                  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+				eventName:            "push",
+				repository:           "sigstore/fulcio",
+				workflow:             "foo",
+				ref:                  "refs/heads/main",
+				jobWorkflowSha:       "example-sha",
+				runnerEnvironment:    "cloud-hosted",
+				repositoryID:         "12345",
+				repositoryOwner:      "username",
+				repositoryOwnerID:    "345",
+				repositoryVisibility: "public",
+				workflowRef:          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+				workflowSha:          "example-sha-other",
+				runID:                "42",
+				runAttempt:           "1",
+			},
+			WantErr: false,
+		},
 		`Token missing job_workflow_ref claim should be rejected`: {
 			Claims: map[string]interface{}{
 				"aud":                   "sigstore",