{"record":{"id":"15da5396483b31ad","repo":"dagger/dagger","slug":"failed-to-fetch-oidc-auth-w","errorCode":null,"errorMessage":"failed to fetch OIDC auth: %w","messagePattern":"failed to fetch OIDC auth: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/auth/auth.go","lineNumber":326,"sourceCode":"\tif oidcErr != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get OIDC token: %w\", oidcErr)\n\t}\n\n\tif err := SetCurrentOrg(&Org{ID: oidcLogin.OrgID, Name: oidcLogin.OrgName}); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to set current org from OIDC token: %w\", err)\n\t}\n\n\treturn oidcLogin.Token, nil\n}\n\nfunc GetDaggerCloudAuth(ctx context.Context, token string) (string, error) {\n\tif token == \"\" {\n\t\treturn \"\", fmt.Errorf(\"DAGGER_CLOUD_TOKEN environment variable is not set\")\n\t}\n\tif token == \"oidc\" {\n\t\toidc, err := fetchOIDCAuth(ctx)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to fetch OIDC auth: %w\", err)\n\t\t}\n\t\treturn \"Bearer \" + oidc, nil\n\t}\n\n\treturn \"Basic \" + base64.StdEncoding.EncodeToString([]byte(token+\":\")), nil\n}\n\ntype oidcTokenResponse struct {\n\tToken   string `json:\"token\"`\n\tOrgID   string `json:\"org_id\"`\n\tOrgName string `json:\"org_name\"`\n}\n\nfunc getOIDCToken(ctx context.Context) (*oidcTokenResponse, error) {\n\t// support for GitHub's OIDC environment variables\n\tghToken := os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\")\n\tghURL := os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\")\n\tif ghToken != \"\" && ghURL != \"\" {","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/internal/cloud/auth/auth.go#L308-L344","documentation":"When GetDaggerCloudAuth is called with the special token value \"oidc\", it delegates to fetchOIDCAuth to obtain a short-lived OIDC bearer token. This error wraps any failure from that fetch, including the underlying 'failed to get OIDC token' and 'failed to set current org' errors. It means OIDC-based authentication with Dagger Cloud could not be completed.","triggerScenarios":"Calling GetDaggerCloudAuth(ctx, \"oidc\") when fetchOIDCAuth fails: OIDC env vars missing in CI (getOIDCToken error) or the local org file cannot be written after a successful exchange (SetCurrentOrg error).","commonSituations":"Setting DAGGER_CLOUD_TOKEN=oidc outside an environment that provides GitHub OIDC variables (local shell, non-GitHub CI); GitHub Actions job missing id-token: write permission; read-only filesystem blocking the org-file write.","solutions":["Inspect the wrapped cause: 'failed to get OIDC token' points to the OIDC exchange, 'failed to set current org' points to a local write problem.","In GitHub Actions, grant the job 'permissions: id-token: write' so the OIDC request token/URL are available.","If not running where OIDC is available, replace the value 'oidc' with a real Dagger Cloud API token in DAGGER_CLOUD_TOKEN.","If the cause is the org-file write, ensure the config directory is writable (mount a writable volume / fix HOME)."],"exampleFix":"# before\nenv:\n  DAGGER_CLOUD_TOKEN: oidc  # fails locally: no OIDC provider\n# after (local run)\nenv:\n  DAGGER_CLOUD_TOKEN: <your-api-token>","handlingStrategy":"fallback","validationCode":"useOIDC := os.Getenv(\"DAGGER_CLOUD_TOKEN\") == \"oidc\" &&\n    os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\") != \"\" &&\n    os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\") != \"\"\nif !useOIDC {\n    // choose a static token path instead\n}","typeGuard":null,"tryCatchPattern":"auth, err := auth.GetDaggerCloudAuth(ctx, \"oidc\")\nif err != nil && strings.Contains(err.Error(), \"failed to fetch OIDC auth\") {\n    if static := os.Getenv(\"DAGGER_CLOUD_TOKEN\"); static != \"\" && static != \"oidc\" {\n        auth, err = auth.GetDaggerCloudAuth(ctx, static)\n    }\n}","preventionTips":["Only use token=\"oidc\" in environments that provide GitHub OIDC variables.","Set 'permissions: id-token: write' on the GitHub Actions job.","Maintain a static API token fallback for local and non-GitHub CI environments.","Resolve the wrapped cause ('failed to get OIDC token' vs 'failed to set current org') before changing configuration."],"tags":["oidc","authentication","github-actions","configuration"],"backgroundTag":"oidc-token-fetch-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}