composable-delivery/Busbar Exchange Action

Exchange a GitHub Actions OIDC token for a short-lived Salesforce access token using RFC 8693 Token Exchange. No stored credentials required.

Trust Signals

workflow.ymlSHA-pinned

uses: composable-delivery/sf-oidc-exchange@f2f9b3653e27161380f1b4fcfafae7c650601512 # v1.0.1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
sf-token-endpoint	Salesforce instance URL of the target org. Example: https://myorg.my.salesforce.com	yes	—
oidc-audience	Audience value to embed in the GitHub OIDC token. Defaults to sf-token-endpoint, which binds the token to the target org so a leaked OIDC token cannot be replayed against a different org.	no	""
token-handler-apex	Developer name of the Apex OauthTokenExchangeHandler registered in the target org. Defaults to BBGitHubTokenExchangeHandler (the Busbar managed package handler).	no	BBGitHubTokenExchangeHandler
sf-alias	Alias to assign to the authenticated org in the Salesforce CLI. Downstream steps can reference the org with --target-org or the alias directly.	no	busbar
set-default-org	Set the authenticated org as the default Salesforce CLI org for subsequent steps. Set to 'false' when authenticating multiple orgs in the same job.	no	true
eca-client-id	Consumer key (client_id) of the Busbar External Client App in the target org. The managed package ships a fixed value that is the same in every subscriber org; only override this when targeting a non-managed or dev-edition ECA with a different consumer key.	no	""
sf-login	Register the exchanged token with the Salesforce CLI (sf org login access-token). Set to 'false' to skip CLI registration and use the access-token output directly.	no	true

name	description
access-token	Short-lived Salesforce access token (5-minute lifetime).
instance-url	Salesforce instance URL of the authenticated org.
sf-alias	Salesforce CLI alias assigned to the authenticated org.