devopshouse/Setup OCI OIDC Auth
Keyless OCI auth via OIDC — exchanges GitHub JWT for OCI UPST, writes ~/.oci/config, and installs the OCI CLI.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 29, 2026
- License
- MIT
Pinned Snippet
uses: devopshouse/oci-oidc-auth-config@0c901f489ab5558b8b46d3aecf1d0213426f78d9 # v1.0.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| config_json | JSON string containing all OCI connection parameters. Required keys: oci_idcs_endpoint, oci_client_id, oci_client_secret, oci_region, oci_tenancy_id, oci_compartment_id. When provided, individual OCI inputs are ignored. | no | "" |
| oci_idcs_endpoint | IDCS identity domain URL (e.g. https://<domain>.identity.oraclecloud.com). Used only when config_json is not provided. | no | "" |
| oci_client_id | OAuth2 confidential application client ID. Used only when config_json is not provided. | no | "" |
| oci_client_secret | OAuth2 confidential application client secret. Used only when config_json is not provided. | no | "" |
| oci_region | OCI region identifier (e.g. sa-saopaulo-1). Used only when config_json is not provided. | no | "" |
| oci_tenancy_id | Tenancy OCID. Used only when config_json is not provided. | no | "" |
| oci_compartment_id | Compartment OCID. Used only when config_json is not provided. | no | "" |
| oidc_audience | Audience claim for the GitHub OIDC token | no | https://cloud.oracle.com |
| oci_profile | OCI config profile name written to ~/.oci/config | no | DEFAULT |
Outputs
| name | description |
|---|---|
| oci_region | OCI region identifier |
| oci_tenancy_id | Tenancy OCID |
| oci_compartment_id | Compartment OCID |
| oci_idcs_endpoint | IDCS identity domain URL |