GitHub Actions - CoreWeave Docs

GitHub Actions workflows can authenticate to CoreWeave AI Object Storage using GitHub’s OIDC tokens. This eliminates the need to store static credentials as repository secrets.

Use within a workflow

The following example workflow uses the coreweave/actions-public/auth/caios-login GitHub Action to configure AI Object Storage access as an AWS profile, then lists the buckets the workflow can access. Replace [ORG-ID] with your CoreWeave organization ID.

name: List AI Object Storage buckets

on:
  workflow_dispatch: {}

jobs:
  caios-ls:
    runs-on: ubuntu-latest
    name: List AI Object Storage buckets
    steps:
      - uses: actions/checkout@v5
      - id: login
        uses: coreweave/actions-public/auth/caios-login@v1.1.0
        with:
          region: US-EAST-04A
          org-id: [ORG-ID]

      - name: List buckets
        run: aws s3 ls

Example IAM policies

Before a GitHub Actions workflow can access AI Object Storage, you must grant the workflow’s OIDC identity permission through an organization access policy. The following examples show how to allow full access to all repositories in a GitHub organization, using either JSON or Terraform.

Always use the organization name with a trailing slash (/) in the role/ bindings when using GitHub Actions. For example, role/https://token.actions.githubusercontent.com:repo:octo-org/* is safe, but role/https://token.actions.githubusercontent.com:repo:octo-org* is unsafe because an organization named octo-org-hacks could match.

JSON
Terraform

{
  "name": "allow-github-org-full-access",
  "version": "v1alpha1",
  "statements": [
    {
      "name": "admin-oidc-identity",
      "effect": "Allow",
      "actions": [
        "s3:*"
      ],
      "resources": [
        "*"
      ],
      "principals": [
        "role/https://token.actions.githubusercontent.com:repo:octo-org/*"
      ]
    }
  ]
}

variable "github_org" {
  type        = string
  description = "The GitHub organization slug, for example octo-org"
}

resource "coreweave_object_storage_organization_access_policy" "test" {
  name = "allow-github-org-full-access"
  statements = [
    {
      name       = "admin-oidc-identity"
      effect     = "Allow"
      resources  = ["*"]
      actions    = ["s3:*"]
      principals = [
        "role/https://token.actions.githubusercontent.com:repo:${var.github_org}/*"
      ]
    }
  ]
}

Last modified on May 29, 2026

​Use within a workflow

​Example IAM policies

Use within a workflow

Example IAM policies