Add support for new Forgejo Authorized Integration feature.

[Bricklou]

Tell us more.

Forgejo recently introduced a new security feature called "Authorized Integration" using OpenID to authorize CI to authenticate against APIs. (see https://forgejo.org/docs/latest/user/api/authorized-integrations/)

Having renovate bot supporting this feature would be a real benefit to reduce security issues related to static token stored in secrets.

[jamietanna]

Interesting - to flesh out the use-case would you be wanting Renovate to take an OpenID Connect ID Token (which is a JSON Web Token) from the environment variables and then use that to authenticate to Forgejo/registries?

[Bricklou]

Yes, that's the idea : control renovate access through an OIDC token. This would include pull requests and issues management and also packages discoverability on forgejo's package registries.

[jamietanna]

What do you envision would change with this? Would it not be a case of you generating that JWT and providing it to Renovate as the RENOVATE_TOKEN, and it'd ✨ just work ✨ ?

(I'm unfamiliar with this and trying to work out how this would look, too)

[Bricklou]

Currently, the forgejo implementation seems to do Authorization: token in the http request headers. This new implementation requires Authorization: Bearer. So there is 2 possibilities:

1. the developer handle the jwt retrieval and pass it to renovate config (with the right config to trigger the bearer header version)
2. renovate handle itself the OIDC authentication to retrieve the JWT and then use it to access what it needs

[itinerare]

From a bit of testing, providing a retrieved JWT to Renovate as the RENOVATE_TOKEN (and/or to access custom registries) already seems to Just Work (at least within the context of the included forgejo actions setup for authorized integrations)... though I couldn't tell you if this is simply a happy accident or not!