{"record":{"id":"c7d1859b10bdb73f","repo":"dagger/dagger","slug":"failed-to-get-oidc-token-w","errorCode":null,"errorMessage":"failed to get OIDC token: %w","messagePattern":"failed to get OIDC token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/auth/auth.go","lineNumber":309,"sourceCode":"\treturn writeFile(orgFile, data, 0o600)\n}\n\nvar (\n\toidcOnce  sync.Once\n\toidcLogin *oidcTokenResponse\n\toidcErr   error\n)\n\nfunc fetchOIDCAuth(ctx context.Context) (string, error) {\n\t// getOIDCToken calls both GitHub OIDC as well as Dagger Cloud's own OIDC endpoint\n\t// It's not a big deal if we call it more than once per session but\n\n\t// it makes sense to avoid it were possible.\n\toidcOnce.Do(func() {\n\t\toidcLogin, oidcErr = getOIDCToken(ctx)\n\t})\n\tif oidcErr != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get OIDC token: %w\", oidcErr)\n\t}\n\n\tif err := SetCurrentOrg(&Org{ID: oidcLogin.OrgID, Name: oidcLogin.OrgName}); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to set current org from OIDC token: %w\", err)\n\t}\n\n\treturn oidcLogin.Token, nil\n}\n\nfunc GetDaggerCloudAuth(ctx context.Context, token string) (string, error) {\n\tif token == \"\" {\n\t\treturn \"\", fmt.Errorf(\"DAGGER_CLOUD_TOKEN environment variable is not set\")\n\t}\n\tif token == \"oidc\" {\n\t\toidc, err := fetchOIDCAuth(ctx)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to fetch OIDC auth: %w\", err)\n\t\t}","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/internal/cloud/auth/auth.go#L291-L327","documentation":"fetchOIDCAuth wraps any error from getOIDCToken (the once-per-process OIDC login that calls GitHub's OIDC endpoint and Dagger Cloud's /v1/oidc endpoint) with this message. It means the OIDC token acquisition failed at some point inside getOIDCToken; the wrapped error (%w) tells you which step (request creation, HTTP call, decode, or Dagger Cloud exchange) actually failed. Because the fetch is memoized with sync.Once, a failed result is cached for the process lifetime and every subsequent call returns the same wrapped error.","triggerScenarios":"Calling GetCloudAuth or GetDaggerCloudAuth with token == \"oidc\" when getOIDCToken fails: missing/malformed ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars in GitHub Actions, network failure reaching the OIDC endpoint, or Dagger Cloud rejecting/exchanging the provider token.","commonSituations":"Running dagger in GitHub Actions without enabling 'permissions: id-token: write' so ACTIONS_ID_TOKEN_REQUEST_TOKEN/URL are empty; running locally where no OIDC env vars exist and no fallback path applies; transient GitHub runner/network outages; Dagger Cloud OIDC endpoint returning a non-token response.","solutions":["Inspect the wrapped (%w) cause to identify which inner step failed, since this message itself is just a wrapper.","In GitHub Actions, add 'permissions: { id-token: write }' to the workflow/job so ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL are populated.","Verify network access from the runner to the ACTIONS_ID_TOKEN_REQUEST_URL and to Dagger Cloud's API endpoint.","If OIDC is not intended, set DAGGER_CLOUD_TOKEN to an actual API token instead of 'oidc' to bypass the OIDC path entirely.","Restart the process if a transient failure was cached by sync.Once (the failed result is memoized for the process lifetime)."],"exampleFix":"# before (GitHub Actions workflow, OIDC disabled by default)\njobs:\n  deploy:\n    steps:\n      - run: dagger run ...\n# after\njobs:\n  deploy:\n    permissions:\n      id-token: write\n    steps:\n      - run: dagger run ...","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\") == \"\" || os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\") == \"\" {\n    // not in a GitHub OIDC-capable environment; don't attempt 'oidc' auth\n    return errors.New(\"OIDC unavailable: ACTIONS_ID_TOKEN_REQUEST_* env vars are not set\")\n}","typeGuard":null,"tryCatchPattern":"auth, err := auth.GetDaggerCloudAuth(ctx, \"oidc\")\nif err != nil && strings.Contains(err.Error(), \"failed to get OIDC token\") {\n    // fall back to a static token or surface the wrapped cause\n    return fmt.Errorf(\"OIDC auth unavailable: %w\", err)\n}","preventionTips":["Always set 'permissions: id-token: write' on GitHub Actions jobs that use token=oidc.","Pre-flight check ACTIONS_ID_TOKEN_REQUEST_TOKEN/URL before choosing the OIDC path.","Remember sync.Once caches the failure — restart the process after fixing env/config.","Keep a static DAGGER_CLOUD_TOKEN fallback for non-OIDC environments."],"tags":["oidc","authentication","ci","github-actions"],"backgroundTag":"oidc-token-fetch-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}