# Copyright 2024 The Sigstore Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

define:
  - &github-type "github-workflow"
  - &gitlab-type "gitlab-pipeline"
  - &codefresh-type "codefresh-workflow"
  - &buildkite-type "buildkite-job"
  - &circleci-type "circleci-job"
oidc-issuers:
  https://accounts.google.com:
    issuer-url: https://accounts.google.com
    client-id: sigstore
    type: email
    contact: tac@sigstore.dev
    description: "Google OIDC auth"
  https://agent.buildkite.com:
    issuer-url: https://agent.buildkite.com
    client-id: sigstore
    type: ci-provider
    ci-provider: *buildkite-type
    contact: support@buildkite.com
    description: "Buildkite Agent OIDC tokens for job identity"
  https://auth.eclipse.org/auth/realms/foundation-service-accounts:
    issuer-url: https://auth.eclipse.org/auth/realms/foundation-service-accounts
    client-id: sigstore
    type: email
    contact: security@eclipse-foundation.org
    description: "Eclipse Foundation Production OIDC provider"
  https://dev.gitlab.org:
    issuer-url: https://dev.gitlab.org
    client-id: sigstore
    type: ci-provider
    ci-provider: *gitlab-type
    contact: distribution-be@gitlab.com
    description: "GitLab OIDC tokens for job identity"
  https://gitlab.archlinux.org:
    issuer-url: https://gitlab.archlinux.org
    client-id: sigstore
    type: ci-provider
    ci-provider: *gitlab-type
    contact: sigstore@archlinux.org
    description: "GitLab OIDC tokens for job identity"
  https://gitlab.com:
    issuer-url: https://gitlab.com
    client-id: sigstore
    type: ci-provider
    ci-provider: *gitlab-type
    contact: support@gitlab.com
    description: "GitLab OIDC tokens for job identity"
  https://issuer.enforce.dev:
    issuer-url: https://issuer.enforce.dev
    client-id: sigstore
    type: chainguard-identity
    contact: mattmoor@chainguard.dev
    description: "Chainguard identity tokens"
  https://issuer.chainops.dev:
    issuer-url: https://issuer.chainops.dev
    client-id: sigstore
    type: chainguard-identity
    contact: priya@chainguard.dev
    description: "Chainguard identity tokens"
  https://issuer.hello.coop:
    issuer-url: https://issuer.hello.coop
    client-id: sigstore
    type: email
    contact: contact@hello.coop
    description: "Hellō OIDC auth"
  https://www.kaggle.com/api/v1/models/signing:
    issuer-url: https://www.kaggle.com/api/v1/models/signing
    client-id: sigstore
    type: email
    contact: support@kaggle.com
    description: "Kaggle OIDC provider"
  https://oauth2.sigstore.dev/auth:
    issuer-url: https://oauth2.sigstore.dev/auth
    client-id: sigstore
    type: email
    issuer-claim: $.federated_claims.connector_id
    contact: tac@sigstore.dev
    description: "dex address for fulcio"
  https://oidc.codefresh.io:
    issuer-url: https://oidc.codefresh.io
    client-id: sigstore
    type: ci-provider
    ci-provider: *codefresh-type
    contact: support@codefresh.io
    description: "Codefresh OIDC tokens for job identity"
  https://ops.gitlab.net:
    issuer-url: https://ops.gitlab.net
    client-id: sigstore
    type: ci-provider
    ci-provider: *gitlab-type
    contact: distribution-be@gitlab.com
    description: "GitLab OIDC tokens for job identity"
  https://token.actions.githubusercontent.com:
    issuer-url: https://token.actions.githubusercontent.com
    client-id: sigstore
    type: ci-provider
    ci-provider: *github-type
    contact: tac@sigstore.dev
    description: "GitHub Actions OIDC auth"
  https://sigstore.verify.ibm.com/oauth2:
    issuer-url: https://sigstore.verify.ibm.com/oauth2
    client-id: sigstore
    type: email
    contact: sigstore@ibm.com
    description: "IBM OIDC auth"
meta-issuers:
  https://*.oic.prod-aks.azure.com/*:
    client-id: sigstore
    type: kubernetes
  https://container.googleapis.com/v1/projects/*/locations/*/clusters/*:
    client-id: sigstore
    type: kubernetes
  https://oidc.circleci.com/org/*:
    client-id: sigstore
    type: ci-provider
    ci-provider: *circleci-type
    # contact: security@circleci.com
    # description: "CircleCI OIDC tokens"
  https://oidc.eks.*.amazonaws.com/id/*:
    client-id: sigstore
    type: kubernetes
  https://oidc.prod-aks.azure.com/*:
    client-id: sigstore
    type: kubernetes
  https://token.actions.githubusercontent.com/*:
    client-id: sigstore
    type: ci-provider
    ci-provider: *github-type
ci-issuer-metadata:
  *github-type:
    default-template-values:
      # url: URL of issuer, https://github.com
      url: "https://github.com"
      # Nil default value to handle optional environment claim
      environment: ""
    extension-templates:
      # event_name: Event that triggered this workflow run. E.g "push", "tag"
      github-workflow-trigger: "event_name"
      # sha: Commit SHA being built
      github-workflow-sha: "sha"
      # workflow (Deprecated): Name of workflow that is running (mutable)
      github-workflow-name: "workflow"
      # repository: Name of repository being built
      github-workflow-repository: "repository"
      # ref: Git ref being built
      github-workflow-ref: "ref"
      # job_workflow_ref: Specific build instructions (i.e. reusable workflow)
      build-signer-uri: "{{ .url }}/{{ .job_workflow_ref }}"
      # job_workflow_sha: Commit SHA to specific build instructions
      build-signer-digest: "job_workflow_sha"
      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
      runner-environment: "runner_environment"
      # repository: Name of repository being built
      source-repository-uri: "{{ .url }}/{{ .repository }}"
      source-repository-digest: "sha"
      source-repository-ref: "ref"
      # repository_id: ID to the source repo
      source-repository-identifier: "repository_id"
      # repository_owner: Owner of the source repo (mutable)
      source-repository-owner-uri: "{{ .url }}/{{ .repository_owner }}"
      # repository_owner_id: ID of the source repo
      source-repository-owner-identifier: "repository_owner_id"
      # workflow_ref: Ref of top-level workflow that is running
      build-config-uri: "{{ .url }}/{{ .workflow_ref }}"
      # workflow_sha: Commit SHA of top-level workflow that is running
      build-config-digest: "workflow_sha"
      build-trigger: "event_name"
      # run_id: ID of workflow run
      # run_attempt: Attempt number of workflow run
      run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
      # repository_visibility: Visibility of the source repo
      source-repository-visibility-at-signing: "repository_visibility"
      # environment: Deployment target for workflow (optional)
      deployment-environment: "environment"
    subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
  *gitlab-type:
    default-template-values:
      url: "https://gitlab.com"
      # Nil default value to handle optional environment claim
      environment: ""
    extension-templates:
      # url: The URL of the GitLab instance. https://gitlab.com
      # ci_config_ref_uri: Ref of top-level pipeline definition.
      # E.g. gitlab.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main
      build-signer-uri: "https://{{ .ci_config_ref_uri }}"
      # ci_config_sha: Commit sha of top-level pipeline definition, and is
      # only populated when `ciConfigRefURI` is local to the GitLab instance
      build-signer-digest: "ci_config_sha"
      # runner_environment: The type of runner used by the job. May be one of gitlab-hosted or self-hosted.
      runner-environment: "runner_environment"
      # project_path: Repository path building built
      source-repository-uri: "{{ .url }}/{{ .project_path }}"
      # sha: Commit SHA being built
      source-repository-digest: "sha"
      # ref_type: The type of the ref
      # E.g. "branch", "tag"
      # ref: Git ref being built
      source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}{{ .ref }}
      # project_id: ID to the source repo
      source-repository-identifier: "project_id"
      # namespace_path: Owner of the source repo (mutable)
      source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
      # namespace_id: ID of the source repo
      source-repository-owner-identifier: "namespace_id"
      build-config-uri: "https://{{ .ci_config_ref_uri }}"
      build-config-digest: "ci_config_sha"
      # pipeline_source: Event that triggered this workflow run. E.g "push", "tag" etc
      build-trigger: "pipeline_source"
      # project_path: Repository building built
      # job_id: job ID
      run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
      # project_visibility: Visibility of the source project
      source-repository-visibility-at-signing: "project_visibility"
      # environment: Deployment target for job (optional)
      deployment-environment: "environment"
    subject-alternative-name-template: "https://{{ .ci_config_ref_uri }}"
  *codefresh-type:
    default-template-values:
      # We are setting the default value for "platform_url" as the ci-provider
      # principal gives priority to the claimed value over the default
      # when they have the same name. Then it will use the default "platform_url" value
      # for cases that the claimed data doesn't exist.
      # platform_url: Codefresh platform url
      platform_url: "https://g.codefresh.io"
      scm_repo_url: ""
      scm_ref: ""
      runner_environment: ""
    extension-templates:
      # workflow_id: The ID of the specific workflow authorized in the claim.
      # For example, 64f447c02199f903000gh20.
      build-signer-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
      runner-environment: "runner_environment"
      # scm_repo_url: Applies to Git push, PR, and manual Git trigger types.
      # The SCM URL specifying the Git repository’s location.
      # For example, https://github.com/codefresh-user/oidc-test
      source-repository-uri: "scm_repo_url"
      # scm_ref: Applies to Git push, PR, and manual Git trigger types.
      # The SCM name of the branch or tag within the Git repository
      # for which the workflow should execute. For example, main or v1.0.0.
      source-repository-ref: "scm_ref"
      # pipeline_id: Codefresh Pipeline id
      build-config-uri: "{{.platform_url}}/api/pipelines/{{ .pipeline_id }}"
      # account_name: Codefresh account name
      # pipeline_name: Codefresh pipline name (project/pipeline)
      # account_id: Codefresh account id
      run-invocation-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
    subject-alternative-name-template: "{{.platform_url}}/{{.account_name}}/{{.pipeline_name}}:{{.account_id}}/{{.pipeline_id}}"
  *buildkite-type:
    default-template-values:
      url: "https://buildkite.com"
    extension-templates:
      # Link to the specific Buildkite job that the OIDC token was generated from
      run-invocation-uri: "{{.url}}/{{.organization_slug}}/{{.pipeline_slug}}/builds/{{.build_number}}#{{.job_id}}"
      # Was the job executed on Buildkite operated compute or customer hosted compute? (valid values: self-hosted, buildkite-hosted)
      runner-environment: "runner_environment"
      # The git sha that job was running, available in the `build_commit` claim
      source-repository-digest: "build_commit"
      # build_source: Event that triggered this workflow run. (valid values: api, ui, webhook, trigger_job, schedule)
      build-trigger: "build_source"
    subject-alternative-name-template: "{{.url}}/{{.organization_slug}}/{{.pipeline_slug}}" # seems correct, do we still need the code in pkg/identity/buildkite/principal.go ?
  *circleci-type:
    default-template-values:
      # principal gives priority to the claimed value over the default
      api_url: "https://circleci.com/api/v2"
    extension-templates:
      # NOTE: Because of how the text/template parsing works with / and . characters,
      # we use " inside our template fragments which is why we use ' to wrap

      # this API call leads back to the exact generated config used for this run
      build-config-uri: '{{.api_url}}/pipeline/{{(index . "oidc.circleci.com/pipeline-id")}}/config'
      # this API call leads back to the definition of the pipeline used for this run
      # https://circleci.com/api/v2/projects/{project_id}/pipeline-definitions/{pipeline_definition_id}
      build-signer-uri: '{{.api_url}}/projects/{{(index . "oidc.circleci.com/project-id")}}/pipeline-definitions/{{(index . "oidc.circleci.com/pipeline-definition-id")}}'
      run-invocation-uri: '{{.api_url}}/workflow/{{(index . "oidc.circleci.com/workflow-id")}}/job'
      runner-environment: '{{if eq (index . "oidc.circleci.com/ssh-rerun") "true"}}ssh-rerun{{ else }}""{{end}}'
      source-repository-ref: '{{index . "oidc.circleci.com/vcs-ref"}}'
      source-repository-uri: '{{index . "oidc.circleci.com/vcs-origin"}}'
    subject-alternative-name-template: '{{.api_url}}/projects/{{(index . "oidc.circleci.com/project-id")}}/pipeline-definitions/{{(index . "oidc.circleci.com/pipeline-definition-id")}}'
