Authenticate Maven against Artifact Registry with OIDC instead of a service account key - #508
Merged
Merged
Conversation
…ervice account key Codefresh federates into GCP with workload identity federation and exports a one-hour GCP_ACCESS_TOKEN, replacing the long-lived ARTIFACT_REGISTRY_SA_KEY. settings.xml authenticates as oauth2accesstoken with that token, for the maven-central mirror and for each repository this build deploys to or reads privately. distributionManagement moves to https, which is what carries the token. The repositories section keeps artifactregistry:// for private registries and the artifactregistry-maven-wagon extension stays: that protocol is what developers and GitHub Actions use, resolving through their own gcloud credentials. Only isda-maven and public-maven move to https there, being public.
Closed
ja6a-regnosys
previously approved these changes
Sep 17, 2026
The extension is not invoked by CI, which reaches Artifact Registry over https with the federated token. It serves developers and GitHub Actions resolving artifactregistry:// through their own gcloud credentials, so the version matters to them rather than to the build.
ja6a-regnosys
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codefresh federates into GCP with workload identity federation and exports a one-hour
GCP_ACCESS_TOKEN, replacing the long-livedARTIFACT_REGISTRY_SA_KEY. Same format as the reviewed and accepted reference implementation for this migration.regnosysops/gcp-oidc-auth:1.0.1distributionManagementmoves tohttps://, which is what carries the tokenrepositories, onlyisda-mavenandpublic-mavenmove tohttps://— they arepublic = true, so CI reads them anonymously. Private registries stay onartifactregistry://, and theartifactregistry-maven-wagonextension stays, because that protocol is what developers and GitHub Actions use through their own gcloud credentialssettings.xmlauthenticates asoauth2accesstokenwith${env.GCP_ACCESS_TOKEN}Supersedes #507, which was rebuilt from the current base to drop unrelated drift.