atsuoishimoto/OIDC SSH CA Certificate
Sign an SSH public key into a short-lived OpenSSH user certificate using an oidc-ssh-ca server and the GitHub Actions OIDC token. No long-lived SSH keys in Secrets.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| ca-url | Base URL of the oidc-ssh-ca signing server (e.g. https://ssh-ca.example.com). The action POSTs to <ca-url>/sign. | yes | — |
| audience | OIDC token audience. Must match the audience expected by the CA server. | yes | — |
| public-key | Path to the SSH public key file to be signed (e.g. id_oidc.pub). You are responsible for generating the key pair beforehand. | yes | — |
| certificate | Path where the signed certificate is written. Defaults to the public key path with the trailing ".pub" replaced by "-cert.pub" (e.g. id_oidc.pub -> id_oidc-cert.pub). | no | "" |
Outputs
| name | description |
|---|---|
| certificate | Path to the signed SSH certificate. |