verifyGitHubActionsOidcToken (auth/github-actions-oidc.ts)

Verifies GitHub Actions OIDC tokens, fetching JWKS and validating claims.

// Source: https://github.com/argos-ci/argos | License: MIT | Copyright 2017 Olivier Tassinari & Greg Bergé
// Provided via justclaw.it.com; keep this notice with the code.
import { createPublicKey } from "node:crypto";
import type { webcrypto } from "node:crypto";
import jwt from "jsonwebtoken";
import z from "zod";

import config from "@/config";
import { boom } from "@/util/error";
import { redisCache } from "@/util/redis";

const GITHUB_ACTIONS_ISSUER = "https://token.actions.githubusercontent.com";
const GITHUB_ACTIONS_AUDIENCE = config.get("api.baseUrl");
const GITHUB_ACTIONS_JWKS_URL =
  "https://token.actions.githubusercontent.com/.well-known/jwks";

const JsonWebKeySchema = z.object({
  kid: z.string(),
  kty: z.literal("RSA"),
  n: z.string(),
  e: z.string(),
  alg: z.string().o

... (truncated -- full source via MCP)