Ability to bulk create trusted publishers

[ekohl]

Is your feature request related to a problem?

As an admin of both Vox Pupuli and The Foreman I'm responsible for a sizeable number of gems. Clicking through the UI is tedious and error prone, so I'd like some programmatic way to set up in bulk.

Describe the solution you'd like

A way to both set up trusted publishing and verify it is indeed set up in a programmatic way.

Perhaps via the gem application, similar to how gem owner allows managing the owner. That allows me to use shell scripts in a loop. Only a REST API would be a good start.

[simi]

@segiddins any plans on trusted publishers API?

[segiddins]

Yup, we can set up an API. It'll probably necessitate adding a new API scope, and also ensuring MFA is given.

[segiddins]

Done in #4690

[ekohl]

Thanks for implementing this. Is there any documentation on how to use this?

[segiddins]

I don't believe so, but it appears https://guides.rubygems.org/rubygems-org-api/ would be a good place to add an entry!

[ekohl]

That is indeed the first place I looked. From reading routes.rb it'll be close to owners in usage. Do I get it right that there's:

• GET - /api/v1/gems/[GEM NAME]/trusted_publishers for a listing publishers for [GEM NAME]
• POST - /api/v1/gems/[GEM NAME]/trusted_publishers to create a publisher for [GEM NAME]
• GET - /api/v1/gems/[GEM NAME]/trusted_publishers/[ID] to show publisher [ID] for [GEM NAME]
• DELETE - /api/v1/gems/[GEM NAME]/trusted_publishers/[ID] to delete publisher [ID] for [GEM NAME]

And for POST the params it allows are from create_params:

rubygems.org/app/controllers/api/v1/oidc/rubygem_trusted_publishers_controller.rb

Lines 55 to 62 in 55c07ac

	def create_params
	create_params = params.permit(
	:trusted_publisher_type,
	trusted_publisher: @trusted_publisher_type.permitted_attributes
	)
	create_params[:trusted_publisher_attributes] = create_params.delete(:trusted_publisher)
	create_params
	end

So the trusted_publisher_type and the permitted_attributes depending on the type. So for GitHub Action:

rubygems.org/app/models/oidc/trusted_publisher/github_action.rb

Lines 38 to 40 in 55c07ac

	def self.permitted_attributes
	%i[repository_owner repository_name workflow_filename environment]
	end

So (also based on reading the tests and output) to create it the payload is:

{
  "trusted_publisher_type": "OIDC::TrustedPublisher::GitHubAction",
  "trusted_publisher": {
    "repository_owner": "$owner",
    "repository_name": "$repo_name",
    "workflow_filename": "$filename",
    "environment": "$env"
  }
}

[ekohl]

GET - /api/v1/gems/[GEM NAME]/trusted_publishers for a listing publishers for [GEM NAME]

Somehow this always returns an empty list. I have tried an API key with the "Index Rubygems" and "Configure Trusted Publishers" permissions.

POST - /api/v1/gems/[GEM NAME]/trusted_publishers to create a publisher for [GEM NAME]
...
So (also based on reading the tests and output) to create it the payload is:

Based on testing I can confirm this works to create a publisher.

GET - /api/v1/gems/[GEM NAME]/trusted_publishers/[ID] to show publisher [ID] for [GEM NAME]

Because listing doesn't work I didn't try this out yet.

DELETE - /api/v1/gems/[GEM NAME]/trusted_publishers/[ID] to delete publisher [ID] for [GEM NAME]

Nor this one.