GITHUB ACTIONS AND VAULT BY HASHICORP

Summary from the TLDR InfoSec newsletter

This article provides a tutorial on how to use OIDC to authenticate GitHub Actions with HashiCorp Vault to retrieve secrets. Vault can be configured to require a set of custom claims in the identity tokens that GitHub uses, allowing for fine-grained policy controls. This can allow GitHub Actions workflows to retrieve secrets without needing to store a long-lived secret or other API key.