Fix assign-reviewer's auth by setting the authorized integration audience
What the developer wrote
Authored by Matt Corallo
Fix assign-reviewer's auth by setting the authorized integration audience
What changed, and why it matters
This is a one-line fix to a Forgejo workflow that assigns reviewers. The workflow requests a temporary identity token from the CI system so it can call another service. The change adds an explicit audience parameter to that token request, ensuring the token is only valid for the intended recipient. Without this, the token might be accepted by a broader set of services or rejected by the intended one, depending on how the CI and target service are configured. It is a hardening/configuration fix rather than a user-facing vulnerability in the Lightning library itself.
No immediate action required for downstream users of rust-lightning. Repository maintainers should verify the audience UUID u:1:bec84b56-6f08-4622-9cd6-1aee5b18c5b9 matches the registered integration and that the workflow now succeeds. Consider auditing other workflows that request OIDC tokens to ensure they also specify an explicit audience.
Security signals we found
OIDC token audience now explicitly scoped
CI workflow authentication hardening
No change to application code or cryptographic logic
Fixes an integration audience mismatch in assign-reviewer automation
Evidence from the diff
The commit modifies .forgejo/workflows/assign-reviewer.yml. The job obtains an OIDC ID token via ACTIONS_ID_TOKEN_REQUEST_URL and previously passed no audience. The patch appends &audience=u:1:bec84b56-6f08-4622-9cd6-1aee5b18c5b9 to the request URL. In Forgejo/Gitea Actions, the audience claim restricts which integration can consume the token. Setting it explicitly binds the token to a specific integration, preventing audience mismatch errors and reducing the chance the token is accepted by an unintended relying party. The change is in CI automation, not in rust-lightning’s Rust code, so it does not affect Lightning node runtime security.
Changed components
.forgejo/workflows/assign-reviewer.ymlForgejo Actions assign-reviewer workflowOIDC ID token issuance for reviewer assignment integrationInspect captured patch +1 / −1
diff --git a/.forgejo/workflows/assign-reviewer.yml b/.forgejo/workflows/assign-reviewer.yml
index 64fed55..71fc81c 100644
--- a/.forgejo/workflows/assign-reviewer.yml
+++ b/.forgejo/workflows/assign-reviewer.yml
@@ -34,7 +34,7 @@ jobs:
id: jwt
run: |
set -eu
- jwt="$(curl -fsS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r '.value')"
+ jwt="$(curl -fsS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=u:1:bec84b56-6f08-4622-9cd6-1aee5b18c5b9" | jq -r '.value')"
echo "::add-mask::$jwt"
echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"
- name: Request review from a random developer
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.