cnuss/Actions Identity
An accessor to various GitHub Actions identity tokens.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| id-token-audience | Optional audience (aud claim) for the OIDC id-token. When set, appended as &audience= to the token request. Ignored when id-token: write is not granted. | no | — |
Outputs
| name | description |
|---|---|
| cache-url | ACTIONS_CACHE_URL — the legacy artifactcache service base URL. |
| id-token | OIDC JWT fetched from ACTIONS_ID_TOKEN_REQUEST_URL when id-token: write is granted. Empty if the permission/env is absent. Masked in logs. |
| id-token-request-url | ACTIONS_ID_TOKEN_REQUEST_URL — the OIDC token request endpoint for this job. |
| results-url | ACTIONS_RESULTS_URL — the results/cache/artifact Twirp service base URL. |
| runtime-token | ACTIONS_RUNTIME_TOKEN — the per-job VSS system-connection bearer the runner injects into node/docker actions. Masked in logs. |
| runtime-url | ACTIONS_RUNTIME_URL — the pipelines service base URL for this job. |
| token | Resolved identity token. Prefers id-token (OIDC JWT) when id-token: write is granted; falls back to runtime-token otherwise. Masked in logs. |