ST-2026-096 · Authentication & identity
GitHub Actions OIDC adopts immutable owner and repository IDs in subject claims
GitHub.com now appends immutable owner and repository IDs to default Actions OIDC subject claims for new repositories and post-15 July renames or transfers; existing repositories change only when opted in.
Previous state
Before the immutable-ID format, the default GitHub Actions OIDC subject claim identified the owner and repository only by mutable names, so a recycled organization or repository name could reproduce a previously trusted subject string.
Current state
On GitHub.com, the default Actions OIDC subject claim appends immutable owner and repository IDs with an @ delimiter. Repositories created after 15 July 2026 and repositories renamed or transferred after that date adopt the format automatically; existing repositories are unchanged unless explicitly opted in.
Affected users
Who needs to care
GitHub.com organizations and repositories whose Actions workflows obtain OIDC tokens for cloud-provider access, especially trust policies that match the default sub claim and repositories that are newly created, renamed, transferred, or deliberately opted in.
Required response
What to do
Preview the immutable subject-claim prefix in the repository or organization OIDC settings UI or API, update the corresponding AWS, Azure, GCP, or other identity-provider trust policy to match the owner@ID/repository@ID format, and verify token exchange before opting in or completing a rename or transfer.
Evidence boundary
What the source does not prove
GitHub's change applies to GitHub.com and does not affect GitHub Enterprise Server. Existing repositories retain the name-only default unless explicitly opted in. GitHub's 10 June 2026 editor note changed the documented delimiter from a hyphen to @; this record uses the revised @ format and does not infer any GHES rollout.
Lifecycle history
Dated event sequence
- Opt-in and preview became available
GitHub announced the immutable-ID subject format and made organization- and repository-level opt-in plus a preview endpoint available for existing repositories.
- Delimiter documentation corrected
GitHub revised the subject format to use @ between each mutable name and immutable ID instead of the previously documented hyphen.
- Automatic adoption began
Repositories created after this date and repositories renamed or transferred after this date automatically use the immutable-ID default subject format.
Evidence ledger
First-party sources
- 01GitHub — Immutable subject claims for GitHub Actions OIDC tokens
Official GitHub Changelog · 2026-04-23
Open official source ↗