action.yml

name: 'Authenticate to Logfire'
author: 'Pydantic Services Inc.'
description: 'Authenticate GitHub Actions to Logfire via OIDC token exchange (RFC 8693) — no secrets, short-lived auto-revoked tokens.'
branding:
  icon: 'lock'
  color: 'purple'

inputs:
  organization:
    description: 'Logfire organization slug. Required unless a full "audience" is provided. Mutually exclusive with "audience".'
    required: false
  project:
    description: 'Logfire project slug. Narrows the workload token to a single project when the trust policy is org-wide; must equal the policy''s project when it is already project-bound. Mutually exclusive with "audience".'
    required: false
  scopes:
    description: 'Space-separated scopes to request (must be a subset of the trust policy). When omitted, the policy''s full scope set is granted. Example: "project:write_otlp project:read_otlp"'
    required: false
  region:
    description: 'Logfire region preset: us, eu, staging-eu. Determines the API URL automatically.'
    required: false
  url:
    description: 'Custom Logfire API URL. Overrides the region preset. Use for self-hosted deployments.'
    required: false
  audience:
    description: 'Full OIDC/exchange audience, used verbatim for both the GitHub OIDC JWT aud claim and the RFC 8693 exchange. Must already encode the org/project path the backend expects. When omitted, the OIDC aud claim defaults to the resolved Logfire URL and the exchange audience is built from "organization"/"project". Mutually exclusive with "organization" and "project".'
    required: false
  job-id:
    description: 'Unique job identifier for traceparent. Use github.job + matrix context in matrix workflows for unique span IDs per combination. Defaults to github.job.'
    required: false
  skip-cleanup:
    description: 'When "true", skip the post-job token revocation and let the token expire naturally. Useful for self-hosted runners that reuse the token across steps after the action completes.'
    required: false
    default: 'false'
  max-retries:
    description: 'Number of retry attempts for transient HTTP failures (network errors, request timeouts, HTTP 408/429, and 5xx), using jittered exponential backoff. A 4xx policy rejection is never retried. Set to 0 to disable retries.'
    required: false
    default: '3'
  request-timeout:
    description: 'Per-request socket timeout in seconds. A request that stalls longer is aborted (and retried, if attempts remain).'
    required: false
    default: '10'
  proxy:
    description: 'Proxy URL (e.g. http://proxy.internal:8080) for reaching Logfire and GitHub OIDC. When omitted, the standard HTTPS_PROXY / HTTP_PROXY / NO_PROXY environment variables are honored.'
    required: false

outputs:
  token:
    description: 'Short-lived Logfire workload access token (JWT). Use it as a bearer token for the API, OTLP intake, gateway proxy, etc. — scopes are determined by the trust policy.'
  traceparent:
    description: 'W3C traceparent header value linking to this workflow run'
  trace_id:
    description: 'Trace ID for this workflow run (deterministic from run context)'
  expires_in:
    description: 'Token TTL in seconds (set by the trust policy)'
  scopes:
    description: 'Granted scopes (may be narrower than requested if the policy narrows them)'
  logfire_url:
    description: 'Resolved Logfire API URL'
  trace-id:
    description: 'Deprecated alias for "trace_id". Will be removed in v2.'
  expires-in:
    description: 'Deprecated alias for "expires_in". Will be removed in v2.'
  logfire-url:
    description: 'Deprecated alias for "logfire_url". Will be removed in v2.'

runs:
  using: 'node24'
  main: 'dist/main.js'
  post: 'dist/cleanup.js'
  post-if: 'always()'