-
Notifications
You must be signed in to change notification settings - Fork 0
[S7] Add OIDC auth to GitHub Action #68
Copy link
Copy link
Open
Labels
github-actionGitHub Action (marketplace)GitHub Action (marketplace)github-integrationGitHub App + Action integrationGitHub App + Action integrationoidcOIDC / keyless authenticationOIDC / keyless authenticationsprint-7Sprint 7: OIDC, Observability & HardeningSprint 7: OIDC, Observability & Hardening
Description
Description
Update the GitHub Action to support OIDC authentication as an alternative to API keys.
Flow
- Check if
api-keyinput is provided - If yes, use API key auth (existing behavior)
- If no, check for
ACTIONS_ID_TOKEN_REQUEST_URLenv var - Request OIDC token from GitHub with
audience: https://api.krakenkey.io - Exchange OIDC token for KrakenKey access token via
/v1/auth/github-oidc - Use KrakenKey token for all subsequent API calls
Requirements
- Workflow needs
permissions: id-token: write - Clear error message if neither API key nor OIDC is available
- Document OIDC setup in README
Acceptance Criteria
- OIDC auth works when no API key provided
- API key auth still works (backward compatible)
- Clear error if neither auth method is available
- README updated with OIDC examples
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
github-actionGitHub Action (marketplace)GitHub Action (marketplace)github-integrationGitHub App + Action integrationGitHub App + Action integrationoidcOIDC / keyless authenticationOIDC / keyless authenticationsprint-7Sprint 7: OIDC, Observability & HardeningSprint 7: OIDC, Observability & Hardening