feat(oidc): on-demand id_token mint for long jobs (reserved proto field 23)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7
- Forks
- 3
- Avg merge
- 2h 12m
- Merged PRs (30d)
- 30
Description
Motivation
id_tokens are minted at dispatch with a TTL (default 1h). A job that exchanges the token after the TTL — long builds before the deploy step — fails intermittently. The docs say 'exchange early'; the real fix is the reserved design: agent requests a fresh mint mid-job via the session (JobAssignment field 23 was reserved for exactly this).
Sketch
New AgentMessage/ServerMessage pair (RequestIDToken / IDTokenResponse) scoped to the job's declared id_tokens; server re-mints via the issuer with the same claims; agent swaps the env var is NOT possible mid-process — instead expose as file or re-exec contract? Design discussion needed: likely a well-known refresh file path + GOCDNEXT_ID_TOKEN_FILE convention.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the reserved JobAssignment field 23 and the proposed AgentMessage/ServerMessage pair for requesting and returning a fresh token. Resolve how the token reaches a running job, including the file-path or re-exec contract and GOCDNEXT_ID_TOKEN_FILE convention. Done means the protocol and delivery behavior are specified well enough to implement without open design questions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, grpc
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100