GitHub OIDC documentation

[wereHamster]

When I was setting up GitHub OIDC, it was not clear to me (neither from the docs nor from the project settings pages) how to set which GitHub repository or workflow is allowed to authenticate with Argos.

When I compare with NPM trusted publishing, there you have to explicitly configure on the npmjs.com side which repo and workflow is allowed to publish. However Argos I assume implicitly allows the Connected Git Repository.

Screenshot from npmjs.com settings:

I'd appreciate if that behavior was explicitly documented in https://argos-ci.com/docs/github-oidc. And even better if here in the settings page I'd see which GitHub repo is allowed (and/or be able to explicitly set the repo):

For example by changing the text to something like:

Allow GitHub Actions workflows in github.com/[owner]/[repo] to authenticate with Argos using short-lived OpenID Connect tokens instead of the project token.

(… if my assumption about how it works is correct)

On the docs page, this is the part that is confusing me:

4. Argos verifies the token's signature, issuer, audience, and claims (repository, ref, workflow) against the project's authentication settings.

On the project authentication settings page, I see no way to specify repository, ref, or workflow. If the text read something like:

4. Argos verifies the token's signature, issuer, audience, and repository claim against the project's Connected Git Repository.

then it would be clearer.

[gregberge]

Hi @wereHamster, thanks for these suggestions. Indeed the UX was not good and clear.

I updated the documentation: https://argos-ci.com/docs/learn/integrations/github-oidc-authentication

And I also updated the UX based on your feedbacks: #2238