ezgh iam bots oidc-trust add <bot> --provider <p> --subject <pattern> [--claim name=value …] [flags]Let workloads holding an ID token from --provider exchange it for the bot’s API keys, when the token’s sub matches --subject (* is any run of characters) and each --claim equals the token’s claim exactly. Prefer claims that survive renames, like GitHub’s repository_id and repository_owner_id. For GitHub Actions the subject must start with repo:<owner>/ unless a claim pins repository_owner_id or repository_id: repo:* would trust every repository on GitHub.
GitHub sends sub as repo:<owner>/<repo>:<context> or, with IDs, as repo:<owner>@<owner id>/<repo>@<repo id>:<context> (GitHub decides which). repo:*:<context> with the repository’s ID pinned fits both; get the ID with gh api repos/<owner>/<repo> --jq .id. When an exchange is refused, ezgh auth oidc-exchange prints the token’s sub to compare.
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*:ref:refs/heads/main' --claim repository_id=804930151
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*:environment:production' --claim repository_id=804930151
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*' --claim repository_owner_id=1342004
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:acme/app:ref:refs/heads/main'
ezgh iam bots oidc-trust add deployer --provider gitlab --subject 'project_path:acme/app:ref_type:branch:ref:main'Part of ezgh iam bots oidc-trust.
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--claim |
string, repeatable | name=value: a claim the token must have, exactly (repeat for more, at most 10) | |
--provider |
string | the OIDC provider, by ID, slug, name or issuer (required) | |
--subject |
string | the pattern the token’s sub must match; * is any run of characters (required) |
This command also takes the global flags.