Struct GithubJWKS

pub struct GithubJWKS {
    pub keys: Vec<JWK>,
}

Represents a set of JSON Web Keys (JWKS) used for GitHub token validation.

This structure is crucial for GitHub Actions authentication because:

1. GitHub Key Rotation: GitHub rotates its keys for security, and having multiple keys allows your application to validate tokens continuously during these changes.

2. Multiple Environments: Different GitHub environments (like production and development) might use different keys. A set of keys allows your app to work across these environments.

3. Fallback Mechanism: If one key fails for any reason, your app can try others in the set.

Think of it like a key ring for a building manager. They don’t just carry one key, but a set of keys for different doors or areas.

Fields

keys: Vec<JWK>

Vector of JSON Web Keys

Implementations

impl GithubJWKS

pub fn validate_github_token( &self, token: &str, config: &GitHubOIDCConfig, ) -> Result<GitHubClaims, GitHubOIDCError>

Validates a GitHub OIDC token against the provided JSON Web Key Set (JWKS).

This method performs several checks:

1. Verifies the token format.
2. Decodes the token header to find the key ID (kid).
3. Locates the corresponding key in the JWKS.
4. Validates the token signature and claims.
5. Optionally checks the token’s audience.
6. Verifies the token’s organization and repository claims against environment variables.

Arguments

• token - The GitHub OIDC token to validate.
• jwks - An Arc<RwLock<GithubJWKS>> containing the JSON Web Key Set.
• config - A GitHubOIDCConfig struct containing validation options.
• expected_audience - An optional expected audience for the token.

Returns

Returns a Result<GitHubClaims, GitHubOIDCError> containing the validated claims if successful, or an error if validation fails.

Trait Implementations

impl Debug for GithubJWKS

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for GithubJWKS

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for GithubJWKS

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.