Post #4493077

“The difference between these two is small but important: GitLab requires the OIDC audience (the aud) to be declared up-front and statically, while GitHub requires the workflow to dynamically request a token with an audience selected at runtime (the audience parameter in the HTTP request).” https://blog.yossarian.net/2026/08/10/github-actions-needs-oidc-audience-constraints