jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-25 02:17:36 -05:00
Code Issues Projects Releases Wiki Activity

Update versioning for secure OIDC in reusable workflows (#39793)

Browse Source 
Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>
This commit is contained in:
Isaac Brown
2023-07-31 09:57:12 +01:00
committed by GitHub
parent c4dcb954ea
commit 1003488ffd
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
data/features/restricted-permissions-oidc.yml Normal file
View File

@@ -0,0 +1,6 @@
# Issue 10918
# Stricter permissions for securely enabling OpenID Connect (OIDC) in a reusable workflows
versions:
fpt: '*'
ghec: '*'
ghes: '>=3.10'

2
data/reusables/actions/oidc-permissions-token.md
View File

@@ -20,6 +20,7 @@ permissions:
id-token: write # This is required for requesting the JWT
```
{% ifversion restricted-permissions-oidc %}
You may need to specify additional permissions here, depending on your workflow's requirements.
For reusable workflows that are owned by the same user, organization, or enterprise as the caller workflow, the OIDC token generated in the reusable workflow can be accessed from the caller's context.
@@ -27,3 +28,4 @@ For reusable workflows outside your enterprise or organization, the `permissions
This ensures that the OIDC token generated in the reusable workflow is only allowed to be consumed in the caller workflows when intended.
For more information, see "[AUTOTITLE](/actions/using-workflows/reusing-workflows)."
{% endif %}