github-script-oidc.yaml

name: OIDC Access Test with GitHub Actions (using github-script)

on:
    workflow_dispatch:

permissions:
  id-token: write
  contents: read

# Official GitHub documentation on configuring OIDC tokens for GitHub Enterprise Server:
# https://docs.github.com/en/enterprise-server@3.17/actions/how-tos/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers

# NOTE: OIDC tokens should be requested just before they are used, as they are short-lived.

jobs:
  access-protected-service:
    runs-on: kubernetes
    steps:
      - name: Get OIDC token with correct audience
        id: get-token-correct
        uses: actions/github-script@v6
        with:
          script: |
            const core = require('@actions/core');
            const token = await core.getIDToken("protected-nginx"); 
            core.addMask(token);
            core.setOutput('token', token);
      
      - name: Access protected NGINX # this should succeed, since the audience is correct
        run: |
          curl -v -H "Authorization: Bearer ${{ steps.get-token-correct.outputs.token }}" \
               http://secured-nginx-service.oidc-experiments.svc.cluster.local/

      - name: Get OIDC token with incorrect audience
        id: get-token-incorrect
        uses: actions/github-script@v6
        with:
          script: |
            const core = require('@actions/core');
            const token = await core.getIDToken("foobar");
            core.addMask(token);
            core.setOutput('token', token);

      - name: Access protected NGINX # this should fail, since the audience is incorrect
        run: |
          curl -v -H "Authorization: Bearer ${{ steps.get-token-incorrect.outputs.token }}" \
               http://secured-nginx-service.oidc-experiments.svc.cluster.local/