v3.15.0

What's Changed

Authenticate with a GitHub Actions OIDC token

A GitHub Actions job that sets permissions: id-token: write and provides BITRISE_BUILD_CACHE_OIDC_POLICY_ID + BITRISE_BUILD_CACHE_WORKSPACE_ID now authenticates with no token and no stored secret. The CLI fetches a GitHub OIDC token, exchanges it at app.bitrise.io/oidc/token for a Workspace API token, caches it, and exchanges again before it expires.

The exchange runs in the credential precedence chain after the injected credentials and before the stores, in the same slot as Build Hub brokering and ahead of it. Nothing changes off GitHub Actions, and nothing changes when a token is already configured.

A rejected exchange reports the job's sub, repository, ref and event_name, because the endpoint itself only ever answers invalid_token. doctor distinguishes "configured, not exchanged yet" and a missing id-token: write permission or workspace from "no credentials".

The exchanged credential is a Workspace API token rather than a JWT, so it is not mirrored into the analytics block as a durable login, and the Bazel credential helper passes Bazel its real expiry.

Gradle verification

For reference, the verification metadata is available as an attached asset.

Changelog

• 06befef Merge pull request #567 from bitrise-io/ACI-5523-github-actions-oidc

Gradle verification

For reference, the verification metadata is available as an attached assset.