Add JoinAttrs conversion for GitHub and GitLab

api/proto/teleport/workloadidentity/v1/attributes.proto

@@ -88,18 +88,16 @@ message JoinAttrsGitLab {
   // If there is no configured environment, this field is false.
   bool environment_protected = 12;
   // The ID of the runner that this pipeline is running on.
-  uint32 runner_id = 13;
+  int64 runner_id = 13;
   // The type of runner that is processing the pipeline.
   // Either `gitlab-hosted` or `self-hosted`.
   string runner_environment = 14;
   // The SHA of the commit that triggered the pipeline run.
   string sha = 15;
-  // The CI config ref URI.
+  // The ref URI of the CI config configuring the pipeline.
   string ci_config_ref_uri = 16;
-  // The CI config ref.
-  string ci_config_ref = 17;
-  // The JTI of the GitLab JWT that was used to join.
-  string jti = 18;
+  // The Git SHA of the CI config ref configuring the pipeline.
+  string ci_config_sha = 17;
 }
 
 // Attributes that are specific to the GitHub (`github`) join method.

lib/githubactions/githubactions.go

@@ -21,6 +21,8 @@ package githubactions
 import (
 	"github.com/gravitational/trace"
 	"github.com/mitchellh/mapstructure"
+
+	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 )
 
 // GitHub Workload Identity
@@ -118,3 +120,24 @@ func (c *IDTokenClaims) JoinAuditAttributes() (map[string]interface{}, error) {
 	}
 	return res, nil
 }
+
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitHub {
+	attrs := &workloadidentityv1pb.JoinAttrsGitHub{
+		Sub:             c.Sub,
+		Actor:           c.Actor,
+		Environment:     c.Environment,
+		Ref:             c.Ref,
+		RefType:         c.RefType,
+		Repository:      c.Repository,
+		RepositoryOwner: c.RepositoryOwner,
+		Workflow:        c.Workflow,
+		EventName:       c.EventName,
+		Sha:             c.SHA,
+		RunId:           c.RunID,
+	}
+
+	return attrs
+}

lib/gitlab/gitlab.go

@@ -19,9 +19,6 @@
 package gitlab
 
 import (
-	"github.com/gravitational/trace"
-	"github.com/mitchellh/mapstructure"
-
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 )
 
@@ -114,27 +111,27 @@ type IDTokenClaims struct {
 	ProjectVisibility string `json:"project_visibility"`
 }
 
-// JoinAuditAttributes returns a series of attributes that can be inserted into
-// audit events related to a specific join.
-func (c *IDTokenClaims) JoinAuditAttributes() (map[string]interface{}, error) {
-	res := map[string]interface{}{}
-	d, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
-		TagName: "json",
-		Result:  &res,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if err := d.Decode(c); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return res, nil
-}
-
-func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.GitLabJoinAttrs {
-	attrs := &workloadidentityv1pb.GitLabJoinAttrs{
-		Sub: c.Sub,
+// JoinAttrs returns the protobuf representation of the attested identity.
+// This is used for auditing and for evaluation of WorkloadIdentity rules and
+// templating.
+func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitLab {
+	attrs := &workloadidentityv1pb.JoinAttrsGitLab{
+		Sub:                  c.Sub,
+		Ref:                  c.Ref,
+		RefType:              c.RefType,
+		RefProtected:         c.RefProtected == "true",
+		NamespacePath:        c.NamespacePath,
+		ProjectPath:          c.ProjectPath,
+		UserLogin:            c.UserLogin,
+		UserEmail:            c.UserEmail,
+		PipelineId:           c.PipelineID,
+		Environment:          c.Environment,
+		EnvironmentProtected: c.EnvironmentProtected == "true",
+		RunnerId:             int64(c.RunnerID),
+		RunnerEnvironment:    c.RunnerEnvironment,
+		Sha:                  c.SHA,
+		CiConfigRefUri:       c.CIConfigRefURI,
+		CiConfigSha:          c.CIConfigSHA,
 	}
 
 	return attrs