Short-lived OIDC for CI: kill every long-lived GitHub Actions token
AWS OIDC, GCP WIF, Azure federated credentials
May 3, 20268 min read29
Command Palette
Search for a command to run...
Series
S08: Identity for the 144-to-1 World
Non-human identities outnumber humans 144 to 1 in Q1 2026. Service accounts, agents, bots, sidecars, CI jobs. Your IdP was built for a 1:1 world. The old patterns (long-lived PATs, static .env, keyless-only-at-the-edge) fall apart at this scale.
Identity is a platform product, not an IT ticket. SPIFFE as the lingua franca, short-lived OIDC as the cloud bridge, IaaS attestation as the trust root, cert-manager as the rotation service. This series wires the full stack.