Hacker News Reader

I wish GitHub Actions had a mechanism for authenticating to third-party services without secrets.

It could be as simple as calling a metadata API only available from inside a GitHub Actions container and obtain a oauth2 token/JWT for an external audience.

View on HN

This would be great. Then we could reliably use something like vault to store secrets with individual acls per-workflow, and have reasonable confidence that only that single workflow can access them.

I don't get the obsession with secrets...

Why not give us some signed JWTs for external authentication.

Secrets is only good for legacy systems.

Reply on news.ycombinator.com