Finding / codex
2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentials
The Responses API proxy can exchange GitHub Actions OIDC credentials. The proxy offers optional GitHub Actions OIDC federation and renewable short-lived OpenAI credentials, keeping API-key mode as default. OIDC mode restricts the upstream Responses endpoint. It requires HTTPS and rejects redirects for the supplied GitHub request URL, but does not establish that GitHub owns that destination. The caller supplies trusted identity mapping and request credentials.
Channel: tagged-release. Half: capability. Date: 2026-10-23.
Operator consequence: Evaluate this component before retaining long-lived CI API secrets. Protect the runner request credential and destination URL, scope repository/ref/workflow identity, and test renewal failure. This is not a universal new CLI sign-in method.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentials
Profile citations
- Codex / claim / github-oidc-proxy
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentialsgithub.com/openai/codex/commit/57560e9d53f89c7737c7b2069ba2eb8fddbf0687tagged commit file2026-10-24-codex-the-responses-api-proxy-can-exchange-github-actions-oidc-credentialsopenai/codex / codex-rs/responses-api-proxy/README.md