Version updated for https://github.com/gamesapeca/gha-oidc-auditor to version v0.1.0.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, gha-oidc-auditor, analyzes GitHub Actions workflows for vulnerabilities related to OpenID Connect (OIDC) authentication, including privilege leaks, injection sinks, unpinned dependencies, and insecure trigger combinations. It provides a deterministic static analysis tool with context-aware evaluation capabilities, offensive exploit chain synthesis, and automated least-privilege policy generation for AWS, GCP, Azure, HashiCorp Vault, and Kubernetes environments.

What’s Changed

gha-oidc-auditor v0.1.0

Static Security Analyzer, Cloud Trust Policy Synthesizer, Remediation-as-Code Engine & Zero-Prerequisite Exploit Chain Generator for GitHub Actions OIDC.

gha-oidc-auditor is an application security posture management (ASPM) and cloud infrastructure entitlement management (CIEM) platform specifically engineered for GitHub Actions Workload Identity Federation / OpenID Connect (OIDC). It bridges the gap between CI/CD workflow security and cloud provider IAM configurations.

1. Core Capabilities & Architectural Pillars

2. Complete Rules Matrix (OIDC-001 through OIDC-012)

3. Offensive Exploit Chains (Bug Bounty Mode)

Execute with --bounty-mode --generate-poc to produce submission-ready reports complete with CVSS 3.1 scoring, vulnerability classifications, reproduction steps, and deterministic cloud token exfiltration commands:

• CHAIN-001 (Pwn-Request RCE via pull_request_target) [CWE-94 - CVSS 9.8 Critical]
• CHAIN-002 (Public Trigger Shell Command Injection) [CWE-78 - CVSS 9.8 Critical]
• CHAIN-003 (JavaScript Code Injection in actions/github-script) [CWE-94 - CVSS 9.8 Critical]
• CHAIN-004 (Privilege Escalation via workflow_run Artifact Poisoning) [CWE-494 - CVSS 9.3 Critical]
• CHAIN-005 (Token Write Privilege Escalation via pull_request_target) [CWE-269 - CVSS 9.1 Critical]
• CHAIN-006 (Repository Secrets Exfiltration via secrets: inherit) [CWE-522 - CVSS 8.6 High]
• CHAIN-007 (Runner Environment Hijacking via $GITHUB_ENV) [CWE-78 - CVSS 9.8 Critical]
• CHAIN-008 (Self-Hosted Runner Infrastructure Takeover) [CWE-284 - CVSS 9.8 Critical]

4. Remediation-as-Code (Terraform / OpenTofu HCL)

Synthesize complete, production-ready .tf modules for cloud providers:

# Output Terraform HCL to stdout
gha-oidc --path .github/workflows --generate-hcl --format hcl

# Write modular .tf files directly to your infrastructure directory
gha-oidc --path .github/workflows --generate-hcl --hcl-output ./terraform/modules/gha_oidc

Generated AWS IAM OIDC Module Example (with July 2026 Immutable Format):

data "aws_iam_policy_document" "my_service_gha_oidc_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values = [
        "repo:my-org/my-service:ref:refs/heads/main",
        "repo:my-org@*/my-service@*:ref:refs/heads/main" # July 2026 Immutable Numeric ID
      ]
    }
  }
}

resource "aws_iam_role" "my_service_gha_deploy_role" {
  name               = "my-service-gha-deploy"
  assume_role_policy = data.aws_iam_policy_document.my_service_gha_oidc_assume_role.json
  tags = {
    ManagedBy = "gha-oidc-auditor"
    Security  = "Least-Privilege-OIDC"
  }
}

5. Offline Cloud Trust Policy Verification (CIEM Mode)

Cross-audit existing live IAM trust policies against least-privilege standards:

# Verify AWS IAM Trust Relationship
gha-oidc --verify-policy aws_trust_policy.json --cloud-provider aws --repo my-org/my-service

# Verify GCP Workload Identity Pool Provider
gha-oidc --verify-policy gcp_wif_config.json --cloud-provider gcp --repo my-org/my-service

6. Official GitHub Action Usage

Integrate directly into CI/CD pipelines in 3 lines of YAML:

- name: Run GHA OIDC Security Audit
  uses: gamesapeca/gha-oidc-auditor@v0.1.0
  with:
    path: .github/workflows
    fail-on: critical

7. Multiplatform Standalone Binaries

Every binary is cross-compiled with stripped debug symbols and verified via checksums.txt (SHA256):

• gha-oidc-linux-amd64 (Linux 64-bit x86)
• gha-oidc-linux-arm64 (Linux 64-bit ARM)
• gha-oidc-darwin-amd64 (macOS Intel)
• gha-oidc-darwin-arm64 (macOS Apple Silicon)
• gha-oidc-windows-amd64.exe (Windows 64-bit)
• checksums.txt (Cryptographic verification file)

• Gamesapeca
• GitHub Actions