A trust relationship authorizes a GitHub repository to federate with a cloud provider. During workflow execution, the provider evaluates repository and execution context, then exchanges a short-lived OIDC token for cloud credentials. section 9.3.3
Configure the relationship through three workflow stages:
- Create a narrowly scoped relationship between the cloud provider and the repository. section 9.3.3
- Grant workflow- or job-level write permission to id-token so the OIDC handshake can complete. section 9.3.3
- Use the cloud provider’s official action to exchange the OIDC JWT for a cloud access token. section 9.3.3
AWS deployment workflow
A workflow grants id-token and contents permissions, assumes an AWS role through the provider action, and uploads index.html to an S3 bucket.
