Repository navigation
feat(token): add GitHub Actions OIDC identity token provider - #17
Merged
Merged
Conversation
Fetches ID tokens from the Actions runtime so workflows can use them with any exchange, e.g. Anthropic WIF via rfc7523. Tokens are cached until shortly before they expire.
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Network I/O under the mutex prevents waiting callers from honoring context cancellation, and documentation and error reporting need correction.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Adds a GitHub Actions OIDC identity-token provider for downstream credential exchanges.
Changes:
- Fetches and caches runner-issued OIDC tokens.
- Adds configurable audience, endpoint, bearer token, and HTTP client.
- Adds tests and README usage guidance.
| File | Description |
|---|---|
README.md |
Documents provider setup and usage. |
pkg/token/githubactions/option.go |
Defines provider configuration options. |
pkg/token/githubactions/githubactions.go |
Implements token retrieval and caching. |
pkg/token/githubactions/githubactions_test.go |
Tests requests, caching, errors, environment configuration, and RFC 7523 integration. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Let callers waiting on an in-flight fetch return when their context is done, name the specific missing setting in the config error, and scope the README claim to providers that take an identity token.
stoader
approved these changes
Sep 30, 2026
baluchicken
approved these changes
Sep 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds pkg/token/githubactions, an IdentityTokenProvider that fetches ID tokens from the GitHub Actions runtime so workflows can use them with any exchange, e.g. Anthropic WIF via rfc7523. The audience is set at construction, the request URL and token default to the runner's env vars, and tokens are cached until shortly before they expire. README has a usage example.