Production Security

GitHub Actions OIDC Deployment Guide

Replace long-lived deployment keys with short-lived GitHub Actions OIDC credentials and tightly scoped trust conditions. Last updated September 19, 2026.

Replace long-lived deployment keys with short-lived GitHub Actions OIDC credentials and tightly scoped trust conditions. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.

Recommended workflow

Step	Why it matters
Define the workload identity	Choose the repository, branch, environment and workflow conditions that may deploy.
Create narrow trust	Bind token issuer, audience and subject claims to one deployment role.
Request minimum permissions	Grant id-token write only to the job that exchanges the token.
Prove denial paths	Test forks, pull requests and unapproved environments cannot assume the role.

Starter snippet

workflow identity -> OIDC token -> cloud trust policy -> short-lived role session

Review checks

Use protected environments for production.
Limit cloud permissions independently of token trust.
Log role sessions and deployment provenance.
Remove the old static secret after a verified migration.

Common mistakes

Trusting every branch in a repository.
Granting id-token write at workflow scope without need.
Keeping permanent credentials as an undocumented fallback.

Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.

Related Formalint references

Continue with Github Actions Env Secrets Guide, Static Site Deployment Checklist, Deployment Rollback Checklist.