Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

OIDC federation (GitHub Actions)

Workflows request a short-lived OpenID Connect token that a cloud provider exchanges for temporary credentials, instead of storing long-lived keys.

With OIDC federation, a GitHub Actions job requests a signed OpenID Connect token describing where it runs (repository, branch, environment, workflow) and exchanges it with AWS, Google Cloud, Azure or another provider for temporary credentials. The cloud side trusts GitHub's issuer and can restrict access with conditions on claims such as sub.

No long-lived cloud key sits in a secret, so a leaked log or a poisoned workflow yields credentials that expire quickly and only work for the allowed repository and branch. See GitHub's OpenID Connect documentation and leaked cloud keys in GitHub Actions.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.