Access rules

Early access. Registry is rolling out behind an organization flag.

An OIDC access rule lets a workload push or pull with no stored secret at all. A CI job that already has a signed OIDC identity — a GitHub Actions run, a cloud workload identity — presents that token, and if it matches a rule the registry issues a short-lived key scoped to the rule. Nothing long-lived ever touches your CI configuration.

Creating a rule

lbr registry oidc-rule create -r acme-prod \
  --name github-actions \
  --issuer https://token.actions.githubusercontent.com \
  --audience longbridge \
  --subject "repo:acme/*:ref:refs/heads/main" \
  --mode readwrite

Each field narrows who’s trusted:

• --issuer — the OIDC issuer whose tokens you trust.
• --audience — the aud claim the token must carry (audience-less trust is refused).
• --subject — a glob the token’s sub must match, for example only the main branch of repositories under acme/.
• --mode — pull or readwrite for the minted key.
• --repo-prefix — optionally scope the minted key to repository prefixes.

Using it from GitHub Actions

Request an OIDC token for the audience, exchange it, and log in:

permissions:
  id-token: write
steps:
  - id: tok
    run: echo "token=$(curl -sH \"Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN\" \
        \"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=longbridge\" | jq -r .value)" >> "$GITHUB_OUTPUT"
  # exchange steps.tok.outputs.token at the registry's OIDC endpoint, then:
  - run: docker login registry.lngbrdg.com -u "$KEY_ID" -p "$SECRET"

Listing and deleting

lbr registry oidc-rule list -r acme-prod
lbr registry oidc-rule delete <id> -r acme-prod

Where to next

• Registry keys — when the caller can hold a secret.
• Registry with Terraform — declare rules as code.