Function parseToken

pkg/attestation/crafter/runners/oidc/gitlab.go:76–116

(ctx context.Context, providerURL string, tokenString string)

}

func parseToken(ctx context.Context, providerURL string, tokenString string) (*GitlabToken, error) {
	provider, err := oidc.NewProvider(ctx, providerURL)
	if err != nil {
		return nil, fmt.Errorf("failed to connect to OIDC provider: %w", err)
	}

	verifier := provider.Verifier(&oidc.Config{
		SkipClientIDCheck: true, // Skip client ID check since we're just parsing
	})

	idToken, err := verifier.Verify(ctx, tokenString)
	if err != nil {
		return nil, fmt.Errorf("token verification failed: %w", err)
	}

	token := &GitlabToken{
		IDToken:  *idToken,
		RawToken: tokenString,
	}

	// Verify the audience
	if !slices.Contains(idToken.Audience, ExpectedAudience) {
		return nil, fmt.Errorf("invalid audience: expected %q", ExpectedAudience)
	}

	// Extract claims to populate our custom fields
	var claims map[string]interface{}
	if err := idToken.Claims(&claims); err != nil {
		return nil, fmt.Errorf("failed to extract claims: %w", err)
	}

	if configRefURI, ok := claims["ci_config_ref_uri"].(string); ok {
		token.ConfigRefURI = configRefURI
	}

	if runnerEnv, ok := claims["runner_environment"].(string); ok {
		token.RunnerEnvironment = runnerEnv
	}

	return token, nil
}

// To load the auth token we do it in two steps:
// 1 - check if it's explicitly set as an environment variable GITLAB_OIDC