Documentation
¶
Overview ¶
Package githubactions provides an IdentityTokenProvider that fetches OIDC ID tokens from the GitHub Actions runtime, so a workflow can exchange them with any tokenex credentials provider. The job needs the `id-token: write` permission.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func WithAudience ¶
WithAudience sets the aud claim of the issued ID tokens. It must match what the relying party expects. If not set, GitHub uses its default audience (the URL of the repository owner).
func WithHTTPClient ¶
WithHTTPClient sets the HTTP client used for token requests. Defaults to http.DefaultClient.
func WithRequestToken ¶
WithRequestToken overrides the bearer token read from ACTIONS_ID_TOKEN_REQUEST_TOKEN.
func WithRequestURL ¶
WithRequestURL overrides the token request URL read from ACTIONS_ID_TOKEN_REQUEST_URL. Useful when the provider runs somewhere the runner's environment is not inherited, e.g. a container.
Types ¶
type IdentityTokenProvider ¶
type IdentityTokenProvider struct {
// contains filtered or unexported fields
}
IdentityTokenProvider fetches GitHub Actions OIDC ID tokens.
func NewIdentityTokenProvider ¶
func NewIdentityTokenProvider(opts ...option.Option) (*IdentityTokenProvider, error)
NewIdentityTokenProvider creates a provider for GitHub Actions OIDC ID tokens. The request URL and bearer token default to the ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables, which the runner sets for jobs with the `id-token: write` permission.
func (*IdentityTokenProvider) GetToken ¶
func (p *IdentityTokenProvider) GetToken(ctx context.Context, _ ...option.Option) (credential.Token, error)
GetToken fetches a new ID token on every call. Tokens are not cached, since relying parties such as Anthropic WIF reject a token whose jti was already exchanged.
type ProviderOption ¶
type ProviderOption interface {
Apply(*providerConfig)
}
Source Files