upwarden-io/Setup Upwarden
Keyless OIDC auth for CI — every dependency fetch authenticated, attributed, and policy-enforced, in two lines (npm/pip/maven/cargo/go/nuget/bundler).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| tool | Package manager to configure. One of: npm | pnpm | yarn | yarn-classic | pip | uv | poetry | maven | gradle | cargo | go | nuget | bundler | none. The CORE derives the wire protocol, default registry host and URL from this. Use 'none' as an exchange-only escape hatch (acquire a credential, write no files). | yes | — |
| mode | Auth mode. 'keyless' (default) — OIDC JWT exchanged with NO vk_; tenant from verified org ownership. 'keyed' — OIDC JWT exchanged WITH a vk_ selector -> vke_. 'static' — vk_ used directly as the registry credential (no OIDC). | no | keyless |
| tenant-vk | The Upwarden tenant vk_ key. Store as a secret; never inline it. REQUIRED for 'keyed' and 'static'; OMIT for 'keyless'. In 'static' it IS the registry credential; in 'keyed' it is the tenant selector sent as Authorization: Bearer on the exchange. | no | "" |
| unit | The per-package unit NAME (self-declared, non-security METADATA; sent as the x-upwarden-ci-unit header). Omit to auto-discover from the manifest in 'working-directory' (package.json .name / pyproject.toml name / pom.xml <artifactId> / Cargo.toml name / go.mod module). | no | "" |
| registry-host | Registry/proxy host override. When omitted, defaults per tool: npm.pkg.upwarden.io, pypi.pkg.upwarden.io, maven.pkg.upwarden.io, crates.pkg.upwarden.io, go.pkg.upwarden.io, nuget.pkg.upwarden.io, rubygems.pkg.upwarden.io. The exchange endpoint is served on the SAME host at /api/v1/ci/exchange. | no | "" |
| working-directory | Directory whose manifest is read to auto-discover the unit name (when 'unit' is omitted), and the directory the writer targets. Defaults to the job's working directory. | no | . |
| audience | OIDC audience. MUST be upwarden.io — the verifier pins this and rejects any other value with bad_audience. Only used in keyed / keyless. | no | upwarden.io |
Outputs
| name | description |
|---|---|
| credential-id | Public id of the credential (safe to log). For keyed/keyless this is the minted vke_ credential_id (correlate against ci_token_mints); for static it is a stable fingerprint of the vk_. Empty if auth did not complete. |
| registry-host | The registry host that was configured (resolved default if not supplied). |
| registry-url | The fully-resolved registry base URL the tool was pointed at. |
| expires-at | ISO-8601 UTC expiry of the credential (keyed/keyless vke_ only; empty for static, which is long-lived). |
| mode | The auth mode used (keyless | keyed | static). |
| unit | The resolved unit NAME (supplied or auto-discovered; may be empty). |