{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T14:13:51.913Z",
  "record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1",
  "record_kind": "external_reference",
  "title": "OIDC workflows: Caller and reusable-job identity",
  "system": "GitHub Actions OIDC",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a valid GitHub OIDC token prove an approved reusable deployment workflow ran?",
  "near_questions": [
    "Which claims describe the caller?",
    "What does job_workflow_ref identify?",
    "Does the provider support that claim?",
    "Is the expected workflow reference constrained?",
    "Is the audience checked?",
    "Does the subject include the intended boundary?",
    "Is the workflow pinned to a revision?",
    "Can another caller meet the policy?",
    "What proves the active cloud trust rule?",
    "Does token validity prove policy correctness?",
    "Were sensitive token values excluded from the review?",
    "Can I save the workflow-identity basis?"
  ],
  "supported_claims": [
    {
      "claim": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitHub: OIDC with reusable workflows",
    "source_url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1",
    "candidate_record_sha256": "a28ca699226897787db68c952227643a3aee6747b907a2debd51a6627a5354c2",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.",
    "required_buyer_context": "Caller, reusable workflow revision, provider-supported claims and effective trust conditions. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "A valid token proves the expected reusable workflow was authorized.",
    "documented_statement": {
      "status": "documented",
      "statement": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.",
      "source_ids": [
        "github-oidc"
      ]
    },
    "buyer_evidence_required": [
      "Caller identity and called-workflow reference.",
      "Cloud-provider claim support and actual trust policy.",
      "Dated token-claim evidence with sensitive token material removed."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Check caller and callee restrictions separately before accepting workflow-specific cloud access."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "github-oidc",
        "url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows",
        "final_url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows",
        "title": "GitHub: OIDC with reusable workflows",
        "checked_on": "2026-10-16",
        "sha256": "fa44d8b0de334dfbfbeed91c71c8089bbbdfcafb52e17015a60d05c519df124f",
        "bytes": 323975
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the identity binding behind a deployment-credential decision.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Caller, reusable workflow revision, provider-supported claims and effective trust conditions."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#github-oidc-reusable-workflow-caller-and-callee-identity",
  "machine_readable_record": "/varexis-index/records/github-oidc-reusable-workflow-caller-and-callee-identity.json"
}