feat: Store issuer_url with (Pending)GitLabPublishers (#18814)

Author: miketheman

tests/common/db/oidc.py

@@ -55,6 +55,7 @@ class Meta:
     namespace = factory.Faker("pystr", max_chars=12)
     workflow_filepath = "subfolder/example.yml"
     environment = "production"
+    issuer_url = "https://gitlab.com"
 
 
 class PendingGitLabPublisherFactory(WarehouseFactory):
@@ -67,6 +68,7 @@ class Meta:
     namespace = factory.Faker("pystr", max_chars=12)
     workflow_filepath = "subfolder/example.yml"
     environment = "production"
+    issuer_url = "https://gitlab.com"
     added_by = factory.SubFactory(UserFactory)
 
 

tests/unit/accounts/test_views.py

@@ -4093,6 +4093,7 @@ def test_add_pending_oidc_publisher_user_cannot_register(
                     namespace="some-namespace",
                     workflow_filepath="some-filepath",
                     environment="",
+                    issuer_url="https://gitlab.com",
                     added_by_id=user_id,
                 ),
                 PendingGitLabPublisher,
@@ -4398,6 +4399,7 @@ def test_add_pending_oidc_publisher_invalid_form(
                     project="some-repository",
                     workflow_filepath="subfolder/some-workflow-filename.yml",
                     environment="some-environment",
+                    issuer_url="https://gitlab.com",
                     added_by_id=user_id,
                 ),
                 MultiDict(
@@ -4878,6 +4880,7 @@ def test_delete_pending_oidc_publisher_invalid_form(
                     project="some-repository",
                     workflow_filepath="subfolder/some-filename",
                     environment="",
+                    issuer_url="https://gitlab.com",
                     added_by_id=user_id,
                 ),
                 PendingGitLabPublisher,
@@ -4960,6 +4963,7 @@ def test_delete_pending_oidc_publisher_not_found(
                     project="some-repository",
                     workflow_filepath="subfolder/some-filename",
                     environment="",
+                    issuer_url="https://gitlab.com",
                     added_by_id=user_id,
                 ),
                 PendingGitLabPublisher,
@@ -5036,6 +5040,7 @@ def test_delete_pending_oidc_publisher_no_access(
                     project="some-owner",
                     workflow_filepath="subfolder/some-filename",
                     environment="",
+                    issuer_url="https://gitlab.com",
                     added_by_id=user_id,
                 ),
                 PendingGitLabPublisher,

tests/unit/manage/views/test_oidc_publishers.py

@@ -456,6 +456,7 @@ def test_manage_project_oidc_publishers_prefill_unknown_provider(self, monkeypat
                     project="some-project",
                     workflow_filepath="some-workflow-filename.yml",
                     environment="",
+                    issuer_url="https://gitlab.com",
                 ),
                 "fakeenv",
             ),
@@ -948,6 +949,7 @@ def test_constrain_publisher_with_nonempty_environment(
                     "namespace": "some-namespace",
                     "project": "some-project",
                     "workflow_filepath": "some-workflow-filename.yml",
+                    "issuer_url": "https://gitlab.com",
                 },
             ),
         ],
@@ -1375,6 +1377,7 @@ def test_add_oidc_publisher_created(
                     namespace="some-owner",
                     workflow_filepath="subfolder/some-workflow-filename.yml",
                     environment="some-environment",
+                    issuer_url="https://gitlab.com",
                 ),
                 MultiDict(
                     {
@@ -1753,6 +1756,7 @@ def test_add_oidc_publisher_invalid_form(
                 namespace="some-owner",
                 workflow_filepath="subfolder/some-workflow-filename.yml",
                 environment="some-environment",
+                issuer_url="https://gitlab.com",
             ),
             GooglePublisher(
                 email="some-email@example.com",
@@ -1867,6 +1871,7 @@ def test_delete_oidc_publisher_registered_to_multiple_projects(
                 namespace="some-owner",
                 workflow_filepath="subfolder/some-workflow-filename.yml",
                 environment="some-environment",
+                issuer_url="https://gitlab.com",
             ),
             GooglePublisher(
                 email="some-email@example.com",

tests/unit/oidc/models/test_gitlab.py

@@ -255,11 +255,13 @@ def test_gitlab_publisher_admin_details_with_environment(self):
             namespace="fakeowner",
             workflow_filepath="subfolder/fakeworkflow.yml",
             environment="fakeenv",
+            issuer_url="https://gitlab.com",
         )
 
         assert publisher.admin_details == [
             ("Project", "fakeowner/fakerepo"),
             ("Workflow", "subfolder/fakeworkflow.yml"),
+            ("Issuer URL", "https://gitlab.com"),
             ("Environment", "fakeenv"),
         ]
 
@@ -269,11 +271,13 @@ def test_gitlab_publisher_admin_details_without_environment(self):
             namespace="fakeowner",
             workflow_filepath="subfolder/fakeworkflow.yml",
             environment="",
+            issuer_url="https://gitlab.com",
         )
 
         assert publisher.admin_details == [
             ("Project", "fakeowner/fakerepo"),
             ("Workflow", "subfolder/fakeworkflow.yml"),
+            ("Issuer URL", "https://gitlab.com"),
         ]
 
     def test_gitlab_publisher_unaccounted_claims(self, monkeypatch):
@@ -668,6 +672,7 @@ def test_gitlab_publisher_duplicates_cant_be_created(self, db_request):
             namespace="repository_owner",
             workflow_filepath="subfolder/worflow_filename.yml",
             environment="",
+            issuer_url="https://gitlab.com",
         )
 
         db_request.db.add(publisher1)
@@ -678,6 +683,7 @@ def test_gitlab_publisher_duplicates_cant_be_created(self, db_request):
             namespace="repository_owner",
             workflow_filepath="subfolder/worflow_filename.yml",
             environment="",
+            issuer_url="https://gitlab.com",
         )
         db_request.db.add(publisher2)
 
@@ -827,6 +833,7 @@ def test_exists(self, db_request, exists_in_db):
             namespace="repository_owner",
             workflow_filepath="subfolder/worflow_filename.yml",
             environment="",
+            issuer_url="https://gitlab.com",
         )
 
         if exists_in_db:

warehouse/accounts/views.py

@@ -79,6 +79,7 @@
 )
 from warehouse.oidc.interfaces import TooManyOIDCRegistrations
 from warehouse.oidc.models import (
+    GITLAB_OIDC_ISSUER_URL,
     PendingActiveStatePublisher,
     PendingGitHubPublisher,
     PendingGitLabPublisher,
@@ -1901,6 +1902,7 @@ def add_pending_gitlab_oidc_publisher(self):
                 project=form.project.data,
                 workflow_filepath=form.workflow_filepath.data,
                 environment=form.normalized_environment,
+                issuer_url=GITLAB_OIDC_ISSUER_URL,
             ),
             make_existence_filters=lambda form: dict(
                 project_name=form.project_name.data,