3 ms·
I wish GitHub Actions had a mechanism for authenticating to third-party services without secrets. It could be as simple as calling a metadata API only availabl
by jopsen 6y ago
I wish GitHub Actions had a mechanism for authenticating to third-party services without secrets.
It could be as simple as calling a metadata API only available from inside a GitHub Actions container and obtain a oauth2 token/JWT for an external audience.
- captncraig 6y agoThis would be great. Then we could reliably use something like vault to store secrets with individual acls per-workflow, and have reasonable confidence that only that single workflow can access them.
- jopsen 6y agoI don't get the obsession with secrets... Why not give us some signed JWTs for external authentication. Secrets is only good for legacy systems.