proxy-x

Third-party APIs, called with an OIDC ID token instead of their secret. Send a token for the upstream's audience where its client would send the secret; the first rule that takes you picks the credential put in its place. The same as JSON: https://proxy-x.jeeyoungk.com/-/config.

github

GitHub's REST and GraphQL API → https://api.github.com

At https://proxy-x.jeeyoungk.com/github/ and https://github.proxy-x.jeeyoungk.com/
Audience https://proxy-x.jeeyoungk.com/github, sent as Authorization: Bearer <token>

Rule	Caller	Allows	Credential
`dellbrook-ci` Any workflow in a dellbrook repository: reads dellbrook repositories.	`https://token.actions.githubusercontent.com` `sub`: `repo:dellbrook@72772465/*` `repository_owner_id`: `72772465`	`GET` `HEAD` `/repos/dellbrook/*`	`github-read` (not configured here)

git

git over HTTPS, at github.com → https://github.com

At https://proxy-x.jeeyoungk.com/git/
Audience https://proxy-x.jeeyoungk.com/git, sent as Basic auth's password

Rule	Caller	Allows	Credential
`dellbrook-ci` Any workflow in a dellbrook repository: fetches dellbrook repositories.	`https://token.actions.githubusercontent.com` `sub`: `repo:dellbrook@72772465/*` `repository_owner_id`: `72772465`	`GET` `/dellbrook//info/refs` `POST` `/dellbrook//git-upload-pack`	`github-read` (not configured here)