Martin Costello • 6/16/2026

Implementing a custom GitHub token broker

This article details the implementation of a custom GitHub token broker that exchanges GitHub Actions OIDC tokens for GitHub access tokens, using C# and TypeScript. It addresses the rise in supply chain attacks targeting open source projects, such as CVE-2026-33634 and CVE-2026-45321, and explains how a token broker can minimize blast radius if secrets are exfiltrated. The post covers background motivation, how the broker works, and provides a sample repository for readers to implement their own solution. It is a technical tutorial focused on improving security in GitHub Actions workflows.

0 comments

#TypeScript #c #Github Actions