https://github.com/andreaso/gha-oidc-e2e-demo
End-to-end demo to illustrate how GitHub Actions' OIDC support works under the hood.
https://github.com/andreaso/gha-oidc-e2e-demo
Last synced: 5 months ago
JSON representation
End-to-end demo to illustrate how GitHub Actions' OIDC support works under the hood.
- Host: GitHub
- URL: https://github.com/andreaso/gha-oidc-e2e-demo
- Owner: andreaso
- License: mit
- Created: 2024-12-01T15:08:45.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-12-01T15:11:59.000Z (over 1 year ago)
- Last Synced: 2025-10-10T22:44:47.897Z (8 months ago)
- Homepage:
- Size: 3.91 KB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# GitHub Actions OIDC end-to-end demo
This is about [GitHub Actions' OIDC support][1]. In short it allows
you to authenticate your GitHub Actions jobs towards various cloud
providers using OIDC, rather than relying on long-lived service
account credentials.
To make it a bit more clear what's happening under the hood I put
together an end-to-end demo workflow.
* [oidc-auth-e2e-demo.yaml](.github/workflows/oidc-auth-e2e-demo.yaml)
That demo workflow is split into two parts. It starts off by showing
what actually happens inside the GitHub Actions job without relying on
the usual abstractions. Then the workflow continues with an extremely
simplified simulation of what conceptually happens at the cloud
provider's side.
## Usage
Hopefully simply reading the
[oidc-auth-e2e-demo.yaml](.github/workflows/oidc-auth-e2e-demo.yaml)
demo workflow and the
[verify_oidc_jwt.py](.github/helpers/verify_oidc_jwt.py) helper script
will provide a bit of helpful extra context.
Yet in case you decide to clone the repository to be able to muck
around a bit yourself do note that you'll need to modify the
`THAT_CLOUD_CONF_GH_ALLOWED_REPO` environment variable. At least
assuming that you want to be starting off in a passing state.
[1]: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect