Repository navigation
feat: OIDC auth (primary) + static bearer fallback - #2
Conversation
The Mint OIDC token step calls the runner-local token broker
($ACTIONS_ID_TOKEN_REQUEST_URL) and exchanges the broker token
for a short-lived ID token scoped to the configured audience.
Failures are non-fatal: if OIDC env vars aren't present (e.g.
caller forgot 'permissions: id-token: write'), we fall back to
the static PROJECT_EMBED_UPLOAD_TOKEN bearer.
The Upload step now picks BEARER from OIDC if available, else
static bearer, else fails with explicit guidance.
Caller workflows must include in their permissions block:
permissions:
contents: write
pull-requests: write
id-token: write
Static bearer remains supported for repos that don't (or can't)
use OIDC, e.g. manual upload scripts.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b164532311
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| contents: write | ||
| pull-requests: write | ||
| # Mint OIDC tokens. Required for the OIDC auth path. | ||
| id-token: write |
There was a problem hiding this comment.
For existing callers that already set a job permissions block without id-token: write (the README example does this), GitHub treats unspecified permissions as none and a reusable workflow can only maintain or reduce the caller's token permissions, not elevate them. Because this called workflow now requests id-token: write, those callers are rejected before any step runs, so the new static-token fallback never executes even when PROJECT_EMBED_UPLOAD_TOKEN is present. This makes the rollout breaking for exactly the “caller forgot id-token” case described in the change.
Useful? React with 👍 / 👎.
Summary
The reusable `static-passthrough.yml` workflow now mints a GitHub Actions OIDC token and uses it as the upload bearer. Falls back to `PROJECT_EMBED_UPLOAD_TOKEN` if OIDC env isn't available (e.g. caller forgot `id-token: write`).
Companion to baladithyab/baladithyab.github.io#36 which adds the OIDC verifier on the Worker side.
Caller migration
Caller workflows (e.g. each codeseys-embed repo's `build-web-asset.yml`) need this permissions block:
```yaml
permissions:
contents: write
pull-requests: write
id-token: write # NEW for OIDC mint
```
After the personal-site PR merges and this PR merges:
Behaviour
The Worker auth path (PR #36) accepts both, so the rollout is non-breaking.
🤖 Generated with the help of Claude