defakto-security/Setup SPIFFE
Mint a SPIFFE SVID for a GitHub Actions job by attesting its OIDC token to a Defakto trust domain.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| trust-domain-id | Defakto tenant ID (e.g. `td-0000000`) — NOT the SPIFFE trust domain name. Used to construct the agent endpoint `<trust-domain-id>.agent.spirl.com:443` that performs the attestation handshake. Can also be supplied via the `DEFAKTO_TRUST_DOMAIN_ID` environment variable. Required when no Workload API socket is configured, and required when `mode: serverless` is set. | no | — |
| workload-socket-endpoint | Optional. SPIFFE Workload API endpoint to talk to instead of performing the attestation handshake. Accepts the same forms as the `SPIFFE_ENDPOINT_SOCKET` env var (`unix:///path/to/socket`, `unix://path`, `unix:path`, or a bare path). When set — either via this input or via `SPIFFE_ENDPOINT_SOCKET` in the environment — and `mode` is `auto` (the default), the Action talks the standard SPIFFE Workload API and the `trust-domain-id` / attestation flow is skipped. Use `mode: serverless` to force the attestation flow even when a socket is configured in the environment. | no | — |
| mode | Optional. Selects how the Action obtains an SVID. One of: `auto` (default) — use the Workload API if `workload-socket-endpoint` or `SPIFFE_ENDPOINT_SOCKET` is set, otherwise fall back to serverless attestation; `serverless` — always perform serverless attestation, ignoring any `SPIFFE_ENDPOINT_SOCKET` in the environment (useful on runners where a socket is exported but the job wants attestation); `workload-api` — require a Workload API socket and fail if none is configured. | no | auto |
| jwt-svid-audience | Optional. If set, the Action additionally fetches a JWT-SVID with this audience and exposes it via the `jwt-svid` output and `jwt-svid-path` file. Multiple audiences can be supplied as a comma-separated list. | no | — |
| output-dir | Directory to write SVID material into. Defaults to `${RUNNER_TEMP}/spiffe`. The directory is created if it does not exist. | no | — |
| export-env | When `true` (default), exports `SPIFFE_X509_SVID`, `SPIFFE_X509_KEY`, `SPIFFE_X509_BUNDLE`, and (if applicable) `SPIFFE_JWT_SVID` env vars pointing at the written files for later steps in the same job. | no | true |
Outputs
| name | description |
|---|---|
| spiffe-id | The SPIFFE ID (URI) granted to this job, e.g. `spiffe://example.org/github/owner/repo`. |
| x509-svid-path | Filesystem path to the PEM-encoded X.509 SVID certificate chain (leaf first). |
| x509-key-path | Filesystem path to the PEM-encoded PKCS#8 private key for the SVID. |
| x509-bundle-path | Filesystem path to the PEM-encoded trust bundle for the SVID's trust domain. |
| expires-at | ISO-8601 timestamp at which the X.509 SVID expires. |
| jwt-svid-path | Filesystem path to the JWT-SVID (only set when `jwt-svid-audience` was provided). |
| jwt-svid | The raw JWT-SVID compact serialization, masked in logs (only set when `jwt-svid-audience` was provided). |