[Identity] Add GitHubActionsCredential by vcolin7 · Pull Request #50916 · Azure/azure-sdk-for-java

vcolin7 · 2026-10-22T09:12:19Z

Description

Adds GitHubActionsCredential and GitHubActionsCredentialBuilder to both Java Identity packages so GitHub Actions workflows can authenticate through OIDC federation without a client secret or certificate.

Fixes #50642.

Reads the GitHub runner's OIDC configuration, derives the assertion audience for the six supported clouds, and uses the existing confidential-client authentication and token-cache paths.
Supports explicit tenant/client ID overrides with environment fallbacks and build-time validation. Keeps DefaultAzureCredential unchanged.
Adds deterministic tests, compiled snippets, JavaDoc, README/troubleshooting guidance, and changelog entries. Includes an opt-in live workflow with a test-branch push trigger and manual dispatch.

Adapts the reference implementation in Azure/azure-sdk-for-js#38581 to each Java package's existing builder and token APIs. No Swagger or TypeSpec regeneration is involved.

Validation

Live E2E passed on this PR head: workflow run. Both packages were built from source and executed:

mvn -B -ntp -f "$SDK_POM" test -Dtest=GitHubActionsCredentialLiveTest

Each package reported one live test, zero failures, zero errors, and zero skips. This exercised real GitHub OIDC and Entra token acquisition, including both token APIs in the existing Identity package and the synchronous v2 API. Workflow lint also passed.

The otherwise successful build logged an existing Revapi scanner error for WindowsCredentialApi.CREDENTIAL_ATTRIBUTE.ByReference, so its API-analysis result is inconclusive. Full repository test suites were not run. The branch retains its existing main synchronization merge commits.

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

Written with the help or Copilot

…github-actions-credential

azure-pipelines · 2026-10-22T09:13:03Z

Azure Pipelines: Successfully started running 1 pipeline(s). 34 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

🔵 Needs a closer look

The cross-package authentication addition needs human review, with unresolved async correctness issues and inconclusive API compatibility analysis.

2 open issues

What changed in this PR

Adds standalone GitHubActionsCredential support to both Java Identity packages, enabling secretless authentication through GitHub Actions OIDC federation without changing DefaultAzureCredential.

Changes:

Adds credential builders, environment configuration, and audience mappings for six supported clouds.
Reuses existing authentication and token-cache infrastructure, with deterministic tests and an opt-in live workflow.
Adds compiled examples, setup and troubleshooting documentation, and release notes.

File	Description
`sdk/identity/azure-identity/TROUBLESHOOTING.md`	Documents configuration and authentication failures.
`sdk/identity/azure-identity/src/test/java/com/azure/identity/GitHubActionsCredentialTest.java`	Tests token exchange, caching, failures, and request options.
`sdk/identity/azure-identity/src/test/java/com/azure/identity/GitHubActionsCredentialLiveTest.java`	Adds opt-in synchronous and asynchronous live checks.
`sdk/identity/azure-identity/src/test/java/com/azure/identity/GitHubActionsCredentialBuilderTest.java`	Tests configuration precedence, validation, and audiences.
`sdk/identity/azure-identity/src/samples/java/com/azure/identity/credential/JavaDocCodeSnippets.java`	Adds compiled credential construction examples.
`sdk/identity/azure-identity/src/main/java/com/azure/identity/GitHubActionsCredentialBuilder.java`	Resolves and validates credential configuration.
`sdk/identity/azure-identity/src/main/java/com/azure/identity/GitHubActionsCredential.java`	Implements OIDC assertion retrieval and token acquisition.
`sdk/identity/azure-identity/README.md`	Explains federation setup, cloud audiences, and live testing.
`sdk/identity/azure-identity/CHANGELOG.md`	Records the new credential feature.
`sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/GitHubActionsCredentialTest.java`	Tests v2 token exchange, caching, and failures.
`sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/GitHubActionsCredentialLiveTest.java`	Adds an opt-in v2 live authentication check.
`sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/GitHubActionsCredentialJavaDocCodeSnippets.java`	Provides compiled v2 documentation examples.
`sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/GitHubActionsCredentialBuilderTest.java`	Tests v2 configuration and audience selection.
`sdk/identity-v2/azure-identity/src/main/java/com/azure/v2/identity/GitHubActionsCredentialBuilder.java`	Adds v2 configuration resolution and validation.
`sdk/identity-v2/azure-identity/src/main/java/com/azure/v2/identity/GitHubActionsCredential.java`	Implements synchronous v2 federated authentication.
`sdk/identity-v2/azure-identity/README.md`	Documents v2 setup, usage, and troubleshooting.
`sdk/identity-v2/azure-identity/pom.xml`	Configures snippet discovery in test sources.
`sdk/identity-v2/azure-identity/CHANGELOG.md`	Records the v2 credential feature.
`.github/workflows/identity-github-actions-credential.yml`	Builds both packages and runs opt-in live authentication tests.

_{Review effort: Balanced}

KarishmaGhiya · 2026-10-28T21:06:42Z

+    env:
+      AZURE_TENANT_ID: ${{ vars.AZURE_IDENTITY_GITHUB_ACTIONS_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ vars.AZURE_IDENTITY_GITHUB_ACTIONS_CLIENT_ID }}
+      AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/


this value is there by default for the authority host. We don't need to mention it.

KarishmaGhiya · 2026-10-29T22:34:47Z

+        }
+    }
+
+    private static String readAssertion(Response<BinaryData> response) {


I was wondering that we could have error message compatibility across languages on this. https://github.com/Azure/azure-sdk-for-js/pull/38581/changes#diff-3b6a7dcba9e90d666bcd7e019746284e95303c04dbdacbc7c70fc82b924c33e5R20 These are some that are covered by JS. Maybe for cases like null or failed to pass OIDC response we can align. It just makes debugging cross language easier in case of customer reports. But this looks thorough to me.

vcolin7 added 9 commits October 20, 2026 01:42

Add GitHub Actions credential to Azure Identity

b91d08d

Add GitHub Actions credential to Identity v2

b159374

Add GitHub Actions credential live tests

da6a7c8

Merge commit 'e492fbe63363558821fc267818b62e5f42886289' into vcolin7-…

76bf195

…github-actions-credential

Merge commit '50c204e32a363f1b122cfd4b0cb74c7127c4853f' into vcolin7-…

b13ac2c

…github-actions-credential

Merge commit '51525d7c1fad6eb26fc3dc30958f034ed6bf7f0f' into vcolin7-…

480854b

…github-actions-credential

Merge commit 'ed5c42f371e12815c6055572b0e11d5a13eb3d61' into vcolin7-…

a8f2b48

…github-actions-credential

Merge commit 'e827d94d5eb45e92a7400a4cc59271b55aeb1329' into vcolin7-…

ed53422

…github-actions-credential

Merge commit '806284f9d27a64cc45b5f487e2de0802dd16debe' into vcolin7-…

b10fac2

…github-actions-credential

Copilot AI balanced review requested due to automatic review settings October 22, 2026 09:12

vcolin7 requested review from a team and Vinay Gera (g2vinay) as code owners October 22, 2026 09:12

vcolin7 requested review from Jonathan Cárdenas (JonathanCrd), KarishmaGhiya, Anannya Patra (anannya03), Maor Leger (maorleger), Minh-Anh Phan (minhanh-phan) and Steven Vukelich (vukelich) October 22, 2026 09:12

github-actions Bot added the Azure.Identity label Oct 22, 2026

github-project-automation Bot added this to Azure Identity SDK Improvements Oct 22, 2026

github-project-automation Bot moved this to Untriaged in Azure Identity SDK Improvements Oct 22, 2026

Copilot started reviewing on behalf of vcolin7 October 22, 2026 09:13

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread sdk/identity/azure-identity/src/main/java/com/azure/identity/GitHubActionsCredential.java Resolved

Comment thread sdk/identity/azure-identity/src/main/java/com/azure/identity/GitHubActionsCredential.java Resolved

vcolin7 added 3 commits October 22, 2026 02:50

Improve GitHub Actions credential setup diagnostics

9ff1aea

Updated CSpell files

51e6b0e

Relocated snippet ffiles for AZure Identity V2

b05b5df

vcolin7 force-pushed the vcolin7-github-actions-credential branch from f6ac393 to b05b5df Compare October 22, 2026 11:15

Fix GitHub Actions credential retries and CAE handling

7691857

Jonathan Cárdenas (JonathanCrd) approved these changes Oct 23, 2026

View reviewed changes

KarishmaGhiya reviewed Oct 28, 2026

View reviewed changes

KarishmaGhiya reviewed Oct 29, 2026

View reviewed changes

vcolin7 added 3 commits November 2, 2026 15:12

Align GitHub Actions credential error messages

e173b38

Use the default authority for GitHub Actions live tests

00d231a

Removed unnecessary changelog entries

61b37e9

Navigation Menu

Repository navigation

[Identity] Add GitHubActionsCredential - #50916

[Identity] Add GitHubActionsCredential#50916
vcolin7 wants to merge 16 commits into
Azure:mainfrom
vcolin7:vcolin7-github-actions-credential

vcolin7 commented Oct 22, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Oct 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

KarishmaGhiya Oct 28, 2026

Uh oh!

KarishmaGhiya Oct 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

vcolin7 commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

azure-pipelines Bot commented Oct 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

KarishmaGhiya Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

KarishmaGhiya Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vcolin7 commented Oct 22, 2026 •

edited

Loading