Evidence record / codex
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentials
The Responses API proxy can exchange GitHub Actions OIDC credentials. The proxy offers optional GitHub Actions OIDC federation and renewable short-lived OpenAI credentials, keeping API-key mode as default. OIDC mode restricts the upstream Responses endpoint. It requires HTTPS and rejects redirects for the supplied GitHub request URL, but does not establish that GitHub owns that destination. The caller supplies trusted identity mapping and request credentials.
Channel: tagged-release. Half: capability. Date: 2026-10-23.
Operator consequence: Evaluate this component before retaining long-lived CI API secrets. Protect the runner request credential and destination URL, scope repository/ref/workflow identity, and test renewal failure. This is not a universal new CLI sign-in method.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentials
Profile citations
- Codex / claim / github-oidc-proxy
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentialsgithub.com/openai/codex/commit/57560e9d53f89c7737c7b2069ba2eb8fddbf0687tagged commit file2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentialsopenai/codex / codex-rs/responses-api-proxy/README.md
Versioned source: run artifact