CI/CD Pipeline to Cloud Resource Access

curl -X POST https://fga.authhub.cloud/api/v1/workload-identity/issuers \
  -H "Authorization: Bearer ${AUTHHUB_ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "GitHub Actions (Algo Trading Repos)",
    "issuer_url": "https://token.actions.githubusercontent.com",
    "allowed_audiences": ["https://fga.authhub.cloud"],
    "claim_mappings": [
      { "source_claim": "repository", "target_attribute": "repo", "required": true },
      { "source_claim": "ref", "target_attribute": "git_ref", "required": true },
      { "source_claim": "environment", "target_attribute": "env", "default_value": "development" },
      { "source_claim": "actor", "target_attribute": "author", "required": true },
      { "source_claim": "job_workflow_ref", "target_attribute": "workflow", "required": true }
    ],
    "scope_restrictions": [
      { "pattern": "cloud:deploy:*", "action": "allow" },
      { "pattern": "admin:*", "action": "deny" }
    ],
    "max_token_lifetime_seconds": 1800,
    "auto_provision_enabled": true
  }'

// 1. Build canonical string from issuer and subject
const canonicalString = `${issuerConfig.issuer_url}::${subject}`;
const canonicalHash = createHash('sha256').update(canonicalString).digest('hex');

// 2. Derive deterministic UUIDv5 identity in AuthHub namespace
const workloadId = uuidv5(canonicalString, AUTHHUB_NAMESPACE_UUID);

// 3. Find or auto-provision workload identity record
const identity = await repository.findByCanonicalHash(tenantId, canonicalHash);
if (!identity && issuerConfig.auto_provision_enabled) {
  return await repository.create(tenantId, {
    id: workloadId,
    canonical_hash: canonicalHash,
    issuer_id: issuerConfig.id,
    display_name: String(claims.repository || subject),
    attributes: mappedAttributes
  });
}

definition pipeline/repository {
    relation admin: identity/user
    relation allowed_environment: pipeline/environment
}

definition pipeline/environment {
    relation parent_repo: pipeline/repository
    relation target_cloud_role: cloud/role
}

definition cloud/role {
    relation tenant: tenant/organization
    relation authorized_repo: pipeline/repository
    relation emergency_freeze: system/kill_switch

    permission assume_role = (authorized_repo->allowed_environment->target_cloud_role) 
        with branch_matches_environment 
        - emergency_freeze->frozen
}

caveat branch_matches_environment(git_ref string, environment string) {
    (environment == "production" && git_ref == "refs/heads/main") ||
    (environment == "staging" && (git_ref == "refs/heads/main" || git_ref == "refs/heads/develop")) ||
    (environment == "development")
}

- name: Exchange GitHub OIDC for AuthHub Token
  id: authhub
  run: |
    # 1. Fetch raw OIDC token from runner
    RAW_JWT=$(curl -s -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
      "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://fga.authhub.cloud" | jq -r '.value')

    # 2. RFC 8693 Token Exchange with AuthHub
    RESP=$(curl -s -X POST https://fga.authhub.cloud/oauth/token \
      -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
      -d "subject_token=${RAW_JWT}" \
      -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
      -d "resource=urn:cloud:aws:iam::123456789012:role/AlgoTradingDeployerProd" \
      -d "scope=cloud:deploy:algo-execution")

    echo "AUTHHUB_TOKEN=$(echo $RESP | jq -r '.access_token')" >> $GITHUB_OUTPUT

- name: Assume AWS Production Role
  run: |
    CREDS=$(aws sts assume-role-with-web-identity \
      --role-arn "arn:aws:iam::123456789012:role/AlgoTradingDeployerProd" \
      --role-session-name "GitHubRun-${GITHUB_RUN_ID}" \
      --web-identity-token "${{ steps.authhub.outputs.AUTHHUB_TOKEN }}" \
      --duration-seconds 900)

    export AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.Credentials.AccessKeyId')
    export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.Credentials.SecretAccessKey')
    export AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.Credentials.SessionToken')

    terraform apply -auto-approve

curl -X POST https://fga.authhub.cloud/api/v1/governance/kill-switch \
  -H "Authorization: Bearer ${SECOPS_EMERGENCY_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": "pipeline:deploy:*",
    "reason": "Supply chain compromise detected in dependency build",
    "duration_seconds": 3600
  }'