🚀 [Feature]: OIDC subject claim customization now available for organizations and repositories

src/functions/private/Actions/OIDC/Get-GitHubOidcSubjectClaimForOrganization.ps1

@@ -0,0 +1,55 @@
+function Get-GitHubOidcSubjectClaimForOrganization {
+    <#
+        .SYNOPSIS
+        Get the customization template for an OIDC subject claim for an organization
+
+        .DESCRIPTION
+        Gets the customization template for an OpenID Connect (OIDC) subject claim for an organization.
+
+        .EXAMPLE
+        ```powershell
+        Get-GitHubOidcSubjectClaimForOrganization -Organization 'PSModule' -Context $GitHubContext
+        ```
+
+        Gets the OIDC subject claim customization template for the 'PSModule' organization.
+
+        .NOTES
+        [Get the customization template for an OIDC subject claim for an organization]
+        (https://docs.github.com/rest/actions/oidc#get-the-customization-template-for-an-oidc-subject-claim-for-an-organization)
+    #>
+    [OutputType([pscustomobject])]
+    [CmdletBinding()]
+    param(
+        # The organization name. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Organization,
+
+        # The context to run the command in. Used to get the details for the API call.
+        # Can be either a string or a GitHubContext object.
+        [Parameter(Mandatory)]
+        [object] $Context
+    )
+
+    begin {
+        $stackPath = Get-PSCallStackPath
+        Write-Debug "[$stackPath] - Start"
+        Assert-GitHubContext -Context $Context -AuthType IAT, PAT, UAT
+        # Required permissions: Administration org (read) or read:org
+    }
+
+    process {
+        $apiParams = @{
+            Method      = 'GET'
+            APIEndpoint = "/orgs/$Organization/actions/oidc/customization/sub"
+            Context     = $Context
+        }
+
+        Invoke-GitHubAPI @apiParams | ForEach-Object {
+            Write-Output $_.Response
+        }
+    }
+
+    end {
+        Write-Debug "[$stackPath] - End"
+    }
+}

src/functions/private/Actions/OIDC/Get-GitHubOidcSubjectClaimForRepository.ps1

@@ -0,0 +1,59 @@
+function Get-GitHubOidcSubjectClaimForRepository {
+    <#
+        .SYNOPSIS
+        Get the customization template for an OIDC subject claim for a repository
+
+        .DESCRIPTION
+        Gets the customization template for an OpenID Connect (OIDC) subject claim for a repository.
+
+        .EXAMPLE
+        ```powershell
+        Get-GitHubOidcSubjectClaimForRepository -Owner 'PSModule' -Repository 'GitHub' -Context $GitHubContext
+        ```
+
+        Gets the OIDC subject claim customization template for the 'GitHub' repository.
+
+        .NOTES
+        [Get the customization template for an OIDC subject claim for a repository]
+        (https://docs.github.com/rest/actions/oidc#get-the-customization-template-for-an-oidc-subject-claim-for-a-repository)
+    #>
+    [OutputType([pscustomobject])]
+    [CmdletBinding()]
+    param(
+        # The account owner of the repository. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Owner,
+
+        # The name of the repository without the .git extension. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Repository,
+
+        # The context to run the command in. Used to get the details for the API call.
+        # Can be either a string or a GitHubContext object.
+        [Parameter(Mandatory)]
+        [object] $Context
+    )
+
+    begin {
+        $stackPath = Get-PSCallStackPath
+        Write-Debug "[$stackPath] - Start"
+        Assert-GitHubContext -Context $Context -AuthType IAT, PAT, UAT
+        # Required permissions: Actions repo (read) or repo
+    }
+
+    process {
+        $apiParams = @{
+            Method      = 'GET'
+            APIEndpoint = "/repos/$Owner/$Repository/actions/oidc/customization/sub"
+            Context     = $Context
+        }
+
+        Invoke-GitHubAPI @apiParams | ForEach-Object {
+            Write-Output $_.Response
+        }
+    }
+
+    end {
+        Write-Debug "[$stackPath] - End"
+    }
+}

src/functions/private/Actions/OIDC/Set-GitHubOidcSubjectClaimForOrganization.ps1

@@ -0,0 +1,64 @@
+function Set-GitHubOidcSubjectClaimForOrganization {
+    <#
+        .SYNOPSIS
+        Set the customization template for an OIDC subject claim for an organization
+
+        .DESCRIPTION
+        Creates or updates the customization template for an OpenID Connect (OIDC) subject claim for an organization.
+
+        .EXAMPLE
+        ```powershell
+        Set-GitHubOidcSubjectClaimForOrganization -Organization 'PSModule' -IncludeClaimKeys @('repo', 'context') -Context $GitHubContext
+        ```
+
+        Sets the OIDC subject claim customization template for the 'PSModule' organization.
+
+        .NOTES
+        [Set the customization template for an OIDC subject claim for an organization]
+        (https://docs.github.com/rest/actions/oidc#set-the-customization-template-for-an-oidc-subject-claim-for-an-organization)
+    #>
+    [OutputType([void])]
+    [CmdletBinding(SupportsShouldProcess)]
+    param(
+        # The organization name. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Organization,
+
+        # Array of unique strings. Each claim key can only contain alphanumeric characters and underscores.
+        [Parameter(Mandatory)]
+        [string[]] $IncludeClaimKeys,
+
+        # The context to run the command in. Used to get the details for the API call.
+        # Can be either a string or a GitHubContext object.
+        [Parameter(Mandatory)]
+        [object] $Context
+    )
+
+    begin {
+        $stackPath = Get-PSCallStackPath
+        Write-Debug "[$stackPath] - Start"
+        Assert-GitHubContext -Context $Context -AuthType IAT, PAT, UAT
+        # Required permissions: Administration org (write) or write:org
+    }
+
+    process {
+        $body = @{
+            include_claim_keys = $IncludeClaimKeys
+        }
+
+        $apiParams = @{
+            Method      = 'PUT'
+            APIEndpoint = "/orgs/$Organization/actions/oidc/customization/sub"
+            Body        = $body
+            Context     = $Context
+        }
+
+        if ($PSCmdlet.ShouldProcess("OIDC subject claim for organization [$Organization]", 'Set')) {
+            $null = Invoke-GitHubAPI @apiParams
+        }
+    }
+
+    end {
+        Write-Debug "[$stackPath] - End"
+    }
+}

src/functions/private/Actions/OIDC/Set-GitHubOidcSubjectClaimForRepository.ps1

@@ -0,0 +1,82 @@
+function Set-GitHubOidcSubjectClaimForRepository {
+    <#
+        .SYNOPSIS
+        Set the customization template for an OIDC subject claim for a repository
+
+        .DESCRIPTION
+        Creates or updates the customization template for an OpenID Connect (OIDC) subject claim for a repository.
+        When UseDefault is true, the include_claim_keys are ignored by the API.
+
+        .EXAMPLE
+        ```powershell
+        Set-GitHubOidcSubjectClaimForRepository -Owner 'PSModule' -Repository 'GitHub' -IncludeClaimKeys @('repo', 'context') -Context $GitHubContext
+        ```
+
+        Sets the OIDC subject claim customization template for the 'GitHub' repository.
+
+        .EXAMPLE
+        ```powershell
+        Set-GitHubOidcSubjectClaimForRepository -Owner 'PSModule' -Repository 'GitHub' -UseDefault -IncludeClaimKeys @('repo') -Context $GitHubContext
+        ```
+
+        Resets the OIDC subject claim customization for the 'GitHub' repository to use the default template.
+
+        .NOTES
+        [Set the customization template for an OIDC subject claim for a repository]
+        (https://docs.github.com/rest/actions/oidc#set-the-customization-template-for-an-oidc-subject-claim-for-a-repository)
+    #>
+    [OutputType([void])]
+    [CmdletBinding(SupportsShouldProcess)]
+    param(
+        # The account owner of the repository. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Owner,
+
+        # The name of the repository without the .git extension. The name is not case sensitive.
+        [Parameter(Mandatory)]
+        [string] $Repository,
+
+        # Whether to use the default subject claim template.
+        # When true, the include_claim_keys are ignored by the API.
+        [Parameter(Mandatory)]
+        [bool] $UseDefault,
+
+        # Array of unique strings. Each claim key can only contain alphanumeric characters and underscores.
+        [Parameter(Mandatory)]
+        [string[]] $IncludeClaimKeys,
+
+        # The context to run the command in. Used to get the details for the API call.
+        # Can be either a string or a GitHubContext object.
+        [Parameter(Mandatory)]
+        [object] $Context
+    )
+
+    begin {
+        $stackPath = Get-PSCallStackPath
+        Write-Debug "[$stackPath] - Start"
+        Assert-GitHubContext -Context $Context -AuthType IAT, PAT, UAT
+        # Required permissions: Actions repo (write) or repo
+    }
+
+    process {
+        $body = @{
+            use_default        = $UseDefault
+            include_claim_keys = $IncludeClaimKeys
+        }
+
+        $apiParams = @{
+            Method      = 'PUT'
+            APIEndpoint = "/repos/$Owner/$Repository/actions/oidc/customization/sub"
+            Body        = $body
+            Context     = $Context
+        }
+
+        if ($PSCmdlet.ShouldProcess("OIDC subject claim for repository [$Owner/$Repository]", 'Set')) {
+            $null = Invoke-GitHubAPI @apiParams
+        }
+    }
+
+    end {
+        Write-Debug "[$stackPath] - End"
+    }
+}

src/functions/public/Actions/OIDC/Get-GitHubOidcClaim.ps1

@@ -0,0 +1,76 @@
+function Get-GitHubOidcClaim {
+    <#
+        .SYNOPSIS
+        Get the supported OIDC claim keys for a GitHub instance
+
+        .DESCRIPTION
+        Retrieves the list of supported OpenID Connect (OIDC) claim keys from the OIDC discovery endpoint
+        of a GitHub instance. This endpoint is public and requires no authentication.
+
+        The claim keys returned can be used with Set-GitHubOidcSubjectClaim to customize the OIDC
+        subject claim template for organizations and repositories.
+
+        .EXAMPLE
+        ```powershell
+        Get-GitHubOidcClaim
+        ```
+
+        Gets the supported OIDC claim keys for github.com.
+
+        .EXAMPLE
+        ```powershell
+        Get-GitHubOidcClaim -Context $GitHubContext
+        ```
+
+        Gets the supported OIDC claim keys for the GitHub instance associated with the given context.
+
+        .NOTES
+        [OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
+
+        .LINK
+        https://psmodule.io/GitHub/Functions/Actions/OIDC/Get-GitHubOidcClaim
+    #>
+    [OutputType([string[]])]
+    [CmdletBinding()]
+    param(
+        # The context to run the command in. Used to determine the GitHub instance hostname.
+        # When not provided, defaults to github.com.
+        [Parameter()]
+        [object] $Context
+    )
+
+    begin {
+        $stackPath = Get-PSCallStackPath
+        Write-Debug "[$stackPath] - Start"
+    }
+
+    process {
+        $hostName = 'github.com'
+        if ($Context) {
+            if ($Context -is [string]) {
+                $resolved = Get-GitHubContext -Context $Context -ErrorAction SilentlyContinue
+                if ($resolved) {
+                    $hostName = $resolved.HostName
+                }
+            } elseif ($Context.HostName) {
+                $hostName = $Context.HostName
+            }
+        }
+
+        $issuerHost = if ($hostName -eq 'github.com') {
+            'token.actions.githubusercontent.com'
+        } else {
+            "token.actions.$hostName"
+        }
+
+        $discoveryUri = "https://$issuerHost/.well-known/openid-configuration"
+        Write-Debug "[$stackPath] - Discovery URI: [$discoveryUri]"
+
+        $response = Invoke-RestMethod -Uri $discoveryUri -Method Get
+        $response.claims_supported
+    }
+
+    end {
+        Write-Debug "[$stackPath] - End"
+    }
+}