Conversation
This was referenced Feb 27, 2026
…puts steps Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
pelikhan
approved these changes
Feb 27, 2026
Copilot
AI
changed the title
[WIP] Update compiler to detect secret vault actions in safe outputs
Auto-detect OIDC/vault actions in safe-outputs steps and add id-token:write permission
Feb 27, 2026
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in e2ee8c9. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds automatic id-token: write permission handling for the safe-outputs job when user-provided safe-outputs.steps include known OIDC/vault credential actions, with an explicit safe-outputs.id-token override and schema support.
Changes:
- Auto-detects known OIDC/vault actions in
safe-outputs.stepsand addsid-token: writeto computed safe-outputs job permissions. - Adds
safe-outputs.id-token: write|noneoverride parsing to force-enable or opt out of auto-detection. - Extends the main workflow JSON schema to include the new
safe-outputs.id-tokenfield and adds unit tests for detection/permission computation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_outputs_permissions.go | Adds OIDC/vault action detection from steps and conditionally sets id-token: write. |
| pkg/workflow/safe_outputs_permissions_test.go | Adds tests for step detection and permission computation around id-token. |
| pkg/workflow/safe_outputs_config.go | Parses new safe-outputs.id-token override from frontmatter. |
| pkg/workflow/compiler_types.go | Extends SafeOutputsConfig with IDToken override field. |
| pkg/parser/schemas/main_workflow_schema.json | Updates schema so safe-outputs.id-token is validated/autocompleted. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+37
to
+38
| // Strip the @version suffix before matching | ||
| actionRef, _, _ := strings.Cut(uses, "@") |
There was a problem hiding this comment.
stepsRequireIDToken duplicates action-ref parsing logic that already exists in this package (extractActionRepo in pkg/workflow/action_pins.go). Reusing the shared helper would reduce drift and keep behavior consistent across features that inspect uses: strings (e.g., handling of refs without @).
Suggested change
| // Strip the @version suffix before matching | |
| actionRef, _, _ := strings.Cut(uses, "@") | |
| // Use shared helper to extract the action repository from the uses: string | |
| actionRef := extractActionRepo(uses) | |
| if actionRef == "" { | |
| continue | |
| } |
Comment on lines
+472
to
+482
| // Handle id-token permission override ("write" to force-add, "none" to disable auto-detection) | ||
| if idToken, exists := outputMap["id-token"]; exists { | ||
| if idTokenStr, ok := idToken.(string); ok { | ||
| if idTokenStr == "write" || idTokenStr == "none" { | ||
| config.IDToken = &idTokenStr | ||
| safeOutputsConfigLog.Printf("Configured id-token permission override: %s", idTokenStr) | ||
| } else { | ||
| safeOutputsConfigLog.Printf("Warning: unrecognized safe-outputs id-token value %q (expected \"write\" or \"none\"); ignoring", idTokenStr) | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
The new safe-outputs.id-token parsing logic isn’t covered by tests that exercise extractSafeOutputsConfig. Adding a focused test for accepted values ("write"/"none") and for ignoring invalid values would help prevent regressions in config parsing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enterprise environments use OIDC-based secret managers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, etc.) via GitHub Actions steps in
safe-outputs.steps. The safe-outputs job was missingid-token: write, causing OIDC authentication to fail silently.Changes
ComputePermissionsForSafeOutputsnow scanssafe-outputs.stepsfor known OIDC/vault actions and automatically addsid-token: writeto the safe-outputs job permissionsaws-actions/configure-aws-credentials,azure/login,google-github-actions/auth,hashicorp/vault-action,cyberark/conjur-actionid-tokenfield onsafe-outputsallows overriding auto-detection:id-token: write— always add the permission (even if no vault action is detected)id-token: none— suppress auto-detection (opt-out)pkg/parser/schemas/main_workflow_schema.jsonnow includes theid-tokenfield in thesafe-outputsobject definition, enabling IDE autocomplete and schema validationOriginal prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.