Fetch OpenID Connect (OIDC) JSON web token (JWT) Forgejo v16+

Fetch a short-lived Forgejo JSON Web Token (JWT) for a required Authorized Integration audience and expose it as a reusable action output (jwt).

Usage

Enable OpenID Connect in your Forgejo workflow, then call this action with the audience value (unique audience claim; aud) registered for your Authorized Integration.

# required
enable-openid-connect: true

jobs:
  example:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch package publication token
        id: jwt
        uses: https://hub.psychoinformatics.de/actions/fetch-forgejo-jwt@v1
        with:
          audience: u:1:91a0242e-516e-4fa8-a03c-abcdef123456

      - name: Use JWT
        run: echo "${{ steps.jwt.outputs.jwt }}"

Requirements

• Forgejo v16 or later
• enable-openid-connect: true enabled in the workflow

What it does

This action requests an OIDC token using the Forgejo-provided request URL and token, extracts the JWT value from the response, masks it in logs, and writes it to the action output.

Documentation

See the official Authorized Integrations documentation for details on registering the audience claim and configuring access.

License

MIT