hex_oidc (hex_core v0.20.0)

OIDC token issuance for CI providers, used by Workload Identity.

Summary

Functions

Detects the CI provider issuing OIDC tokens for the current job, if any.

Fetches an OIDC token scoped to Audience from Provider, through the build tool's HTTP adapter, so the request uses the same proxy settings and CA certificates as the rest of the build tool's traffic.

Types

fetch_error/0

-type fetch_error() ::
          {oidc_token_request_failed, Status :: non_neg_integer()} |
          {oidc_token_unavailable, Reason :: term()} |
          oidc_token_missing | json_unavailable.

provider/0

-type provider() :: {github_actions, #{url := binary(), request_token := binary()}}.

Functions

detect_provider()

-spec detect_provider() -> {ok, provider()} | none.

Detects the CI provider issuing OIDC tokens for the current job, if any.

Only GitHub Actions is supported today, detected through the ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables, which GitHub only sets when the job has the id-token: write permission.

fetch_token(Config, Provider, Audience)

-spec fetch_token(hex_core:config(), provider(), Audience :: binary()) ->
                     {ok, binary()} | {error, fetch_error()}.

Fetches an OIDC token scoped to Audience from Provider, through the build tool's HTTP adapter, so the request uses the same proxy settings and CA certificates as the rest of the build tool's traffic.