GitHub Actions needs OIDC audience constraints
Summary
This article argues that GitHub Actions' dynamic runtime OIDC audience requests can enable token misuse, increasing pivot risk if an attacker gains id-token: write access. It compares GitHub's approach to GitLab's static audience model and proposes constraining allowed audiences for a workflow to reduce attack surface, with a note on potential trade-offs when dynamic audiences are required.