jirikuncar/Logfire OIDC Auth
Authenticate GitHub Actions with Logfire via OIDC token exchange (RFC 8693). No secrets needed — GitHub-issued JWTs are exchanged for a short-lived Logfire workload token whose scopes are pinned by your trust policy. The token is automatically revoked when the job completes.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| organization | Logfire organization slug. Required unless a full "audience" is provided. Mutually exclusive with "audience". | no | — |
| project | Logfire project slug. Narrows the workload token to a single project when the trust policy is org-wide; must equal the policy's project when it is already project-bound. Mutually exclusive with "audience". | no | — |
| scopes | Space-separated scopes to request (must be a subset of the trust policy). When omitted, the policy's full scope set is granted. Example: "project:write_otlp project:read_otlp" | no | — |
| region | Logfire region preset: us, eu, staging-eu. Determines the API URL automatically. | no | — |
| url | Custom Logfire API URL. Overrides the region preset. Use for self-hosted deployments. | no | — |
| audience | Full OIDC/exchange audience, used verbatim for both the GitHub OIDC JWT aud claim and the RFC 8693 exchange. Must already encode the org/project path the backend expects. When omitted, the OIDC aud claim defaults to the resolved Logfire URL and the exchange audience is built from "organization"/"project". Mutually exclusive with "organization" and "project". | no | — |
| job-id | Unique job identifier for traceparent. Use github.job + matrix context in matrix workflows for unique span IDs per combination. Defaults to github.job. | no | — |
| skip-cleanup | When "true", skip the post-job token revocation and let the token expire naturally. Useful for self-hosted runners that reuse the token across steps after the action completes. | no | false |
| max-retries | Number of retry attempts for transient HTTP failures (network errors, request timeouts, HTTP 408/429, and 5xx), using jittered exponential backoff. A 4xx policy rejection is never retried. Set to 0 to disable retries. | no | 3 |
| request-timeout | Per-request socket timeout in seconds. A request that stalls longer is aborted (and retried, if attempts remain). | no | 10 |
| proxy | Proxy URL (e.g. http://proxy.internal:8080) for reaching Logfire and GitHub OIDC. When omitted, the standard HTTPS_PROXY / HTTP_PROXY / NO_PROXY environment variables are honored. | no | — |
Outputs
| name | description |
|---|---|
| token | Short-lived Logfire workload access token (JWT). Use it as a bearer token for the API, OTLP intake, gateway proxy, etc. — scopes are determined by the trust policy. |
| traceparent | W3C traceparent header value linking to this workflow run |
| trace-id | Trace ID for this workflow run (deterministic from run context) |
| expires-in | Token TTL in seconds (set by the trust policy) |
| scopes | Granted scopes (may be narrower than requested if the policy narrows them) |
| logfire-url | Resolved Logfire API URL |