GitHub Actions (OIDC)

GitHub Actions can mint a short-lived OIDC token for each workflow run. By federating GitHub as an identity provider, a workflow can run one of your agents without any stored oct_sk_ secret - the token lasts only for the run and is scoped to a single agent.

Register GitHub as a provider

In your project's Settings -> Federation, register a provider:

Issuer: https://token.actions.githubusercontent.com
Allowed algorithms: RS256
Agent scope: bind it to the specific agent the workflow should run. (GitHub's OIDC token carries fixed claims, so use a bound agent rather than an agent claim.)
Claim conditions: restrict to your repository so only it is trusted, for example sub starts with repo:your-org/your-repo:. Keep the trailing colon - GitHub subjects look like repo:org/repo:ref:refs/heads/main, and the colon stops the prefix from also matching a repository whose name merely starts the same (like your-repo-fork).

Copy the generated audience - the workflow requests a token for it.

Workflow

Grant the job id-token: write, request a GitHub OIDC token for your audience, and present it to Octavus.

yaml

javascript

The workflow never stores an Octavus secret. The OIDC token is valid only for that run, is trusted only from your repository (via the claim condition), and can only run the one agent you bound.

Notes

Ephemeral credentials are session-use only. Managing agents or syncing definitions still uses a long-lived key with the appropriate permission, kept in trusted compute.
To stop trusting the workflow, disable or delete the provider in the dashboard - no workflow changes needed.