Add GitHub Actions OIDC workflow for Pomerium verification

[Copilot]

This adds a GitHub Actions workflow that opens https://verify.sv.sandbox.pomerium.io using a GitHub-issued OIDC JWT. The workflow is intended to exercise Pomerium auth directly from Actions without introducing static credentials.

• Workflow

  • Adds .github/workflows/pomerium-verify.yml
  • Triggers on push and workflow_dispatch
  • Requests id-token: write and mints a GitHub OIDC token for the target audience

• Authentication flow

  • Uses actions/github-script@v7 to call core.getIDToken(...)
  • Sends the token to the verify endpoint via the Authorization header
  • Disables redirect following so auth failures are surfaced instead of hidden behind a login redirect

• Operator inputs

  • Supports manual overrides for:
    • url
    • audience
  • Defaults both to https://verify.sv.sandbox.pomerium.io

• Documentation

  • Updates README.md with the workflow purpose and manual dispatch inputs

permissions:
  contents: read
  id-token: write

steps:
  - uses: actions/github-script@v7
    with:
      script: |
        const idToken = await core.getIDToken('https://verify.sv.sandbox.pomerium.io');
        const response = await fetch('https://verify.sv.sandbox.pomerium.io', {
          headers: {
            Authorization: `******
          },
          redirect: 'manual',
        });

Original prompt

I need github actions that will open https://verify.sv.sandbox.pomerium.io and authenticate with github jwt.

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to request a GitHub OIDC JWT at runtime and use it to authenticate an HTTP request to a Pomerium verification endpoint, plus documents how to run it.

Changes:

• Added .github/workflows/pomerium-verify.yml to mint an OIDC token and call the verify URL with Authorization: Bearer <token> while not following redirects.
• Added workflow_dispatch inputs for url and audience (with defaults).
• Updated README.md with workflow purpose and manual-run input documentation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
README.md	Documents the new OIDC-based verification workflow and its manual inputs.
.github/workflows/pomerium-verify.yml	Implements the GitHub Actions OIDC token mint + authenticated fetch to the Pomerium verify endpoint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.