News for hackers. Stuff that matters.

A comment on GitHub Actions Has a Package Manager, and It Might Be the Worst. Parent comment

Re:GitHub Actions Has a Package Manager, and It Might Be the... by jdeastwood on Monday December 08, 2025 @04:48AM (#46190367)
Yes, their oidc setup was probably their last good feature back when they were actually delivering features back in 2020ish. Everyone else copied it within a few months though.
[ Parent | on HN ]
Re:GitHub Actions Has a Package Manager, and It Might Be the... by sofixa on Monday December 08, 2025 @09:25AM (#46192563)
Who is everyone? As with pretty much every GitHub feature, GitLab had them beat by a few years.
[ Parent | on HN ]
Re:GitHub Actions Has a Package Manager, and It Might Be the... by jdeastwood on Monday December 08, 2025 @04:32PM (#46197922)
Maybe in some other form, but the current style of injecting an oidc token was definitely in github actions first. Here is the gitlab issue tracking the final bit of it's implementation directly mentioning github: https://gitlab.com/gitlab-org/gitlab/-/issues/356986
[ Parent | on HN ]
Re:GitHub Actions Has a Package Manager, and It Might Be the... by sofixa on Monday December 08, 2025 @04:35PM (#46197964)
This is the more flexible and secure (specific aud) replacement for CI_JOB_JWT which has been there since at least 2017, if not before. Functionally it was exactly the same, a JWT token per pipeline allowing you to authenticate to third parties that support OIDC/JWT Auth.
[ Parent | on HN ]