feat(ci): support local Kipp packages and fix OIDC scrubbing - #180
Merged
Conversation
When the job grants `id-token: write`, the runner injects fresh OIDC request variables into each step process, so clearing them through GITHUB_ENV does not keep them out of the automation. Delete them from the github-script process instead, where the runtime and the Pi subprocess read them, and drop the separate confirmation step now that the check runs inline.
Add a `package-path` input pointing at a Kipp package already present in the workspace. When it is set the action skips the registry download and reads the name and version from the package manifest, so a workflow can exercise an unpublished build. `kipp-version` is ignored in that mode.
Contributor
🛡️ SHA Pinned Actions Report✅ All 31 file(s) passed — actions are allowed and pinned as required. |
pleb
enabled auto-merge
August 29, 2026 01:09
PatrickDinh
approved these changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent changes to the Kipp Managed Services composite actions.
setup-kipp: use a local Kipp packageAdds a
package-pathinput pointing at a Kipp package already present in the workspace. When it is set the action skips the registry download entirely and reads the package name and version from the manifest, so a workflow can exercise an unpublished build.kipp-versionis ignored in that mode.The path is resolved against
GITHUB_WORKSPACEwhen relative, and rejected when it is not a directory or carries nopackage.json. The manifest version must be an exact semver, and it feeds the existingkipp-versionoutput.run-kipp-automation: make OIDC scrubbing effectivescrub-oidc-envcleared the OIDC request variables throughGITHUB_ENV. When the job grantsid-token: writethe runner injects fresh values into each step process, so that alone did not keep them out of the automation.The github-script step now deletes the variables from its own process before importing the runtime, which is where the runtime and the Pi subprocess read them. The separate confirmation step is replaced by an inline check that throws.
Both inputs stay optional and default to the current behaviour, so existing callers are unaffected.