syntaqxA workflow that deploys to AWS, Google Cloud or Azure with the job's OIDC token now says how to reach the cloud's token service, and the docs say where to look when a job has no token. The issuer, its keys and the token endpoint were already live at https://api.g1t.sh/actions/oidc, and a job with `permissions: id-token: write` already got ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN. But on g1t's machines a job reaches only the hosts its project allows, and no cloud's token exchange is among them, so a login step following the docs failed with a bare 403. The OIDC section of the Actions guide has a new part, Reaching your cloud. It lists the hosts each cloud's login needs (sts.<region>.amazonaws.com; sts.googleapis.com and iamcredentials.googleapis.com; login.microsoftonline.com and management.azure.com) and says to add them as workflow-only domains limited to the deploying workflow and environment. Each cloud's steps now include that step, and the guide says what a job without `id-token: write` sees. The secrets section of the Actions guide, Secrets and variables, and the guardrails page's workflow-only domains each point to OIDC tokens as the way to deploy without keeping a cloud key.5f83f32History
README.md
GitHub's workflow schema
workflow-v1.0.json is GitHub's schema for workflow files, copied unchanged from
actions/languageservices, file
workflow-parser/src/workflow-v1.0.json, at commit
4043eda158e16579cc5fb1b0b07a4bce2a76f0b5 (5 August 2026). It is MIT licensed;
LICENSE is that repository's licence, copied from the same commit.
g1t does not read it at run time. src/syntax.rs lists the keys each part of a
workflow may have, and its tests check those lists against this file, so they
cannot drift from GitHub's. To update it, copy the file again, write the commit
here, and run cargo test -p g1t-actions.