OpenCode Engineer Details OIDC Workaround for Cloudflare Credentials in CI

Key Info

An OpenCode engineer described a workaround for handling Cloudflare API keys securely in CI: the team created a separate AWS account to move off GitHub secrets, since AWS Secrets Manager supports OIDC natively.

Highlights

• A Lambda function with IAM auth is invoked by GitHub Actions to obtain a temporary Cloudflare credential.
• The approach is framed as a hack until Cloudflare adds native OIDC support.
• The setup responds to a question about least-privilege handling of Cloudflare API keys in CI pipelines.
• The author had considered building a custom worker for OIDC but noted it would add another thing to secure.