fix(ci): scope the OIDC scrub to the automation step - #181
Merged
Conversation
The GITHUB_ENV write outlived the step and could not be undone, so it disarmed any later step that legitimately needed OIDC, including setup-kipp's own registry exchange. It never protected a later step either: the runner re-injects fresh values into every step process, so the variables were always repopulated downstream regardless. Deleting the variables from the automation process is sufficient and keeps the control scoped to the step that asked for it.
Contributor
🛡️ SHA Pinned Actions Report✅ All 31 file(s) passed — actions are allowed and pinned as required. |
pleb
enabled auto-merge
August 30, 2026 23:53
slewis74
approved these changes
Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
scrub-oidc-envpreviously did two things: it wrote emptyACTIONS_ID_TOKEN_REQUEST_URLandACTIONS_ID_TOKEN_REQUEST_TOKENvalues toGITHUB_ENV, and it deleted the same variables from the automation process before importing the runtime. This drops theGITHUB_ENVstep and keeps only the in-process deletion.Why
The
GITHUB_ENVwrite outlives the step that made it and cannot be undone within the job. Any later step that legitimately needs OIDC would find the variables blanked for expression evaluation,setup-kipp's own registry exchange included.It bought nothing in exchange. When the job grants
id-token: write, the runner injects fresh values into every step process, so theGITHUB_ENVwrite never actually stopped a later step from minting a token. The protection that matters is the in-process deletion, which is what keeps a model-directed tool call inside the automation from reaching the OIDC endpoint, and that is unchanged (including the guard that refuses to run if either variable survives).Net effect: the control is now scoped to the step that asked for it, instead of leaking across the job.
Changes
Scrub OIDC request variablesstep.scrub-oidc-envinput description to state the guarantee and its step scope.GITHUB_ENVwrite.