3 ms·
OIDC that is a good alternative. This GitHub Action uses OIDC to authenticate the workflow to confirm secrets are only given to the authorized job. The differe
by varunsharma07 4y ago
OIDC that is a good alternative. This GitHub Action uses OIDC to authenticate the workflow to confirm secrets are only given to the authorized job.
The differences between OIDC and MFA for publishing credentials are:
1) More control: each release gets gated by human intervention, requiring MFA to publish.
2) Separation of duties: Just because one has "write" access to the code/ workflow does not automatically permit them to publish.
3) Less management overhead: With MFA, there is no need to set up OIDC trust policies (which need to be configured accurately). This removes the need to manage a separate set of deployment credentials/ policies.