/gcbrun

@di sorry - reviewing contrib rules, realized i hadnt signed or updated the changelog, so did some force pushing

Hmm, looks like our circleci config was only configured to run on pushes to main, I've changed the trigger to be on pushes to PRs or the default branch.

Opening/closing to see if I can kick off that job.

Doesn't seem like it worked. @meeech can you force-push here again?

Not sure what I'm missing. AFAICT circleci is configured to run on PRs: https://github.com/di/id/blob/main/.circleci/config.yml

Here's the settings:

I dont know if it will kick off on my PR if you dont have this enabled -

Aha, that should do it. Mind pushing again?

@di let me set it up on my fork and see why the cci job failing

OOOOO - duh on me. @di this is working as expected. A fork is not allowed to access OIDC token for the parent project. So this is behaving as designed for security reasons.

You can see my run here https://app.circleci.com/pipelines/github/meeech/id/2

Ah, makes sense. At the very least, I think we will want to fail more gracefully when the ambient credential is not present.

@di So I've updated ambient to use stderr. I think that was the mistake. Otherwise, what sort of graceful fail would you like to see? There error seems pretty clear about the source of the fail

question: should I make the same change for the buildkite code? it also references process.stdout for the error message.

CircleCI: the `circleci` tool encountered an error: oidc: error: failed to get oidc token: this project does not allow issuing tokens to forks
Error: exit status 1: oidc: error: failed to get oidc token: this project does not allow issuing tokens to forks

as far as the pipeline goes, we could make that 'sniff' if its a fork (env var CIRCLE_OIDC_TOKEN would be missing from the pipeline), so we could deliver the same message in the pipeline, but that feel redundant since the circleci binary gives a pretty clear message about why it failed.

Anyhow, I'm pretty flexible so let me know what you prefer

There error seems pretty clear about the source of the fail

Yes, this works, thanks! I think we're good.

/gcbrun

@meeech Looks like you need to update the tests to match c432b86.

@di will do. what about buildkite? want to keep it stdout for the error?

/gcbrun