GitHub Actions OIDC lets cloud deploys drop stored keys, but trust conditions decide safety

GitHub Actions can replace a stored cloud access key with OIDC, where GitHub signs a short-lived token for each job that AWS, Google Cloud or Azure exchange for temporary credentials. The security depends entirely on the trust conditions written on the cloud side, since every GitHub repository can obtain a token from the same issuer. Conditions should bind to stable identifiers such as repository ID, a protected environment with required reviewers, or a reusable workflow, rather than a wildcard organization name. The default subject claim format has a weakness: recycled repository or organization names could let a new owner mint matching tokens, so newer repositories use an immutable format that includes numeric IDs. Older repositories must opt into that format through their OIDC settings or the REST API.