[Brooooooklyn]

Motivation

The scaffolded GitHub Actions deploy workflow (void init --github) had two steps: a curl/jq step that GETs a GitHub OIDC token (audience void), POSTs it to $VOID_API_URL/auth/github-oidc, reads .token, and exports VOID_TOKEN; then a void deploy step. This PR moves the exchange into the CLI, so the scaffold collapses to a single void deploy step — no curl/jq.

Detection + exchange flow

New module packages/void/src/cli/github-oidc.ts:

• isGithubActionsOidcAvailable(env) — true iff GITHUB_ACTIONS === 'true' and non-empty ACTIONS_ID_TOKEN_REQUEST_URL and non-empty ACTIONS_ID_TOKEN_REQUEST_TOKEN (i.e. the workflow granted permissions: id-token: write).
• exchangeGithubOidcForDeployToken(apiUrl, project, env):
  1. GET ${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=void with Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN} → .value (the OIDC JWT).
  2. POST ${apiUrl}/auth/github-oidc with JSON { oidcToken, project } → .token (the deploy token).
  • Throws clear, actionable errors (HTTP status + server error body) on any non-OK response or missing field.
• maskGithubActionsSecret(value, env) — emits ::add-mask::<token> to stdout when running in Actions so the token is redacted from logs.

Wired into runDeploy's token resolution: let token = getToken(root); if no token and in Actions, resolve the slug (--project / VOID_PROJECT / linked .void/project.json), exchange, mask, and use it.

Precedence / back-compat

1. Explicit token still wins — getToken() (VOID_TOKEN env or keychain/file). Existing workflows that still curl-exchange set VOID_TOKEN and keep working unchanged.
2. Else if running in GitHub Actions → auto-exchange OIDC. If the slug is unknown, errors: "running in GitHub Actions but the project is unknown — pass --project or link the project."
3. Else → existing not-authenticated error path.

Local (non-Actions) behavior and the VOID_TOKEN path are untouched.

Scaffold change

• Removed the "Exchange GitHub OIDC token…" curl/jq step.
• Kept permissions: id-token: write + contents: read — the CLI now mints the OIDC token, so this permission is still required.
• Kept env: VOID_API_URL and VOID_PROJECT (the CLI reads both).
• Only remaining step after setup+install is ${runner} deploy --project "$VOID_PROJECT".
• Docs updated (docs/guide/deployment.md, docs/reference/cli.md).

Tests

• Unit: isGithubActionsOidcAvailable across env combinations.
• Unit: exchangeGithubOidcForDeployToken with mocked fetch — success returns the token; audience void appended to the GET URL; POST body is exactly {oidcToken, project}; non-OK GET/POST and missing fields throw useful messages; trailing-slash API URL handled.
• Unit: maskGithubActionsSecret (emits in Actions, no-op otherwise / empty value).
• Scaffold: updated init.test.ts to assert the single-step output (no curl/exchange step; id-token: write retained; single deploy step).
• Deploy-path: in-Actions + no VOID_TOKEN triggers the exchange; explicit token skips it; unknown project errors.

All touched tests pass (154), typecheck / lint / fmt clean.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes deploy authentication precedence and CI credential flow (OIDC vs saved tokens); mistakes could affect self-hosted runners or prerender remote bindings, though behavior is covered by new tests and explicit env/OIDC ordering.

Overview
Moves GitHub Actions OIDC → Void deploy-token exchange from the scaffolded workflow into void deploy, so void init --github workflows drop the curl/jq step and only run void deploy (still with permissions: id-token: write).

Adds github-oidc.ts: detect Actions OIDC availability, mint audience void JWT, POST to /auth/github-oidc, mask tokens in logs, and forward CF Access headers for gated APIs.

Deploy auth order is now: explicit VOID_TOKEN env → OIDC exchange in Actions when no env token → saved keychain/config. OIDC is checked before getToken() so a leftover login on a reused runner cannot override the short-lived deploy token. After exchange, the minted token is written to process.env.VOID_TOKEN so build/prerender paths that call getToken() behave like the old $GITHUB_ENV step.

Docs and init scaffold comments/YAML are updated; unit tests cover exchange, precedence, env export, and the slimmer workflow output.

^{Reviewed by Cursor Bugbot for commit cc683fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5faca6394

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b6e70cef22

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".