EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 10·5 min read
GitHub Actions needs OIDC audience constraints
TL;DR
GitHub Actions should implement audience constraints for OpenID Connect (OIDC) tokens to enhance security against potential attacks. A minor syntax change could address this significant vulnerability.
✦ Why It Matters
Consider advocating for audience constraints in GitHub Actions to enhance security in your workflows.
Key Takeaways
- Implement audience constraints for OIDC tokens in workflows.
- Limit token requests to specific services to enhance security.
- Review third-party code for vulnerabilities that could exploit OIDC.
- Consider static audience declarations to prevent unauthorized access.
How It Works
GitHub Actions currently allows workflows to request OIDC tokens dynamically, which can lead to security risks. By requiring workflows to declare acceptable audiences upfront, the system can prevent tokens from being misused across different services.