fix: support immutable GitHub OIDC subjects - #9430
Draft
vhvb1989 wants to merge 2 commits into
Draft
Conversation
Use the repository OIDC API's subject claim prefix when GitHub returns one so pipeline federated credentials match immutable owner and repository IDs. Preserve legacy default subjects and custom claim templates. Fixes #9382 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ce6a0486-2aa3-48df-8636-993e6acdffa2
|
Azure Pipelines: Successfully started running 1 pipeline(s). 21 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for GitHub’s immutable OIDC subject prefixes when configuring pipeline federated credentials.
Changes:
- Parses immutable-subject fields from GitHub’s OIDC configuration.
- Uses API-provided prefixes for default subjects.
- Adds unit and provider-level regression coverage.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
cli/azd/pkg/tools/github/oidc.go |
Parses and applies immutable OIDC prefixes. |
cli/azd/pkg/tools/github/oidc_test.go |
Tests parsing and subject construction. |
cli/azd/pkg/pipeline/github_provider_test.go |
Tests generated federated credentials. |
Preserve GitHub immutable subject prefixes for custom OIDC templates and avoid duplicating the repo claim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ce6a0486-2aa3-48df-8636-993e6acdffa2
Contributor
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #9382
Context
GitHub announced immutable subject claims for GitHub Actions OIDC tokens and automatically enables the new format for repositories created after July 15, 2026:
https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/
The previous subject format was:
The immutable format includes stable owner and repository IDs:
azd pipeline configqueried the repository OIDC configuration but ignored the newsub_claim_prefixresponse field. It therefore created a legacy name-based federated credential even when the GitHub Actions token used an immutable subject, causingAADSTS700213during pipeline authentication.Changes
use_immutable_subjectandsub_claim_prefixfrom GitHub's repository OIDC configuration response.sub_claim_prefixas authoritative for default subject templates.repo:OWNER/REPOfallback when GitHub does not return a prefix.include_claim_keyssubject construction.Compatibility
The implementation does not infer behavior from repository creation dates. Existing repositories can opt in, and repository renames or transfers can also activate immutable subjects. The repository OIDC API response is used as the source of truth, supporting both old and new repositories.
Testing
go test ./pkg/tools/github ./pkg/pipeline