Crate ci_id

Expand description

ci-id provides easy access to ambient OIDC credentials in CI systems like GitHub Actions.

match ci_id::detect_credentials(Some("my-audience")) {
    Ok(token) => println!("{}", token),
    Err(e) => eprintln!("{}", e)
}

§Environment specific setup

Typically the CI environment needs to allow OIDC identity access.

Workflow must be given the permission to use the workflow identity:

permissions:
    id-token: write

An ID token must be defined in the pipeline:

id_tokens:
    MY_AUDIENCE_ID_TOKEN:
        aud: my-audience

The ID token name must be based on the audience so that token name is either

ID_TOKEN for default audience
<AUD>_ID_TOKEN where <AUD> is the audience string sanitized for environment variable names (uppercased and all characters outside of ascii letters and digits are replaced with “_”)

No configuration is needed.