GitHub Actions

GitHub Actions can mint OIDC tokens for a repository's workflows. Tokens always come from https://token.actions.githubusercontent.com. The audience is the GitHub organization or user that owns the repository. You can also require a branch, tag, or environment.

Docs and discovery


Docs	About security hardening with OpenID Connect
Claims	OIDC token claims
Issuer	`https://token.actions.githubusercontent.com`
Discovery	`https://token.actions.githubusercontent.com/.well-known/openid-configuration`

Token


Issuer	`https://token.actions.githubusercontent.com`
Audience	`https://github.com/<owner>`
Repository	`owner/repo`
Branch	`ref` is `refs/heads/<name>`
Tag	`ref` is `refs/tags/<name>`
Environment	`environment`

A token names either a ref or an environment, not both.

Fields

Field	Claim	Required	Validation
Repository	`aud`, `repository`	Yes	`owner/repo`, a GitHub URL, or an SSH remote.
Scope by		No	Any ref, or a branch, tag, or environment.
Branch / tag / environment	`ref` or `environment`	When scoped	Shown when you pick a scope.
Additional claims	other	No	Cannot reuse `aud`, `repository`, `ref`, or `environment`.

You can paste a GitHub link into Repository. A /tree/<branch> link also sets the branch. A /releases/tag/<tag> link sets the tag.

The form pins aud to https://github.com/<owner>, the default audience. If your workflow requests a custom audience, edit compile in the installed file — Additional claims cannot reuse aud.

Example policy

{
  issuer: "https://token.actions.githubusercontent.com",
  claims: {
    aud: ["https://github.com/acme"],
    repository: ["acme/web"],
    ref: ["refs/heads/main"],
  },
}

Add a field

Edit components/oidc/provider-github.tsx after install. For a one-off claim such as workflow_ref, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.

See Add a field.