Teffen Ellis
8f67f8f564
The npm publish job is the highest-value target in this repo's CI: it has `id-token: write` for OIDC trusted publishing against the npm registry and runs against a checkout of `main`. A compromised dep introduced anywhere in the package graph could exfiltrate the OIDC token in the window it is valid, or quietly tamper with the build output before publish. Adds `step-security/harden-runner` in `audit` mode as the first step of the publish job. Audit mode does not block egress; it captures every outbound connection and surfaces anomalies in the Step Security Insights dashboard. This is intentionally the conservative initial posture — we get observability without risking a broken publish from an incomplete allow-list. A follow-up should promote `egress-policy` to `block` with an explicit `allowed-endpoints` list once we have one or two real publish runs to baseline against. Pinned to v2.19.3 (ab7a9404c0f3da075243ca237b5fac12c98deaa5). Co-authored-by: Agent <279763771+playpen-agent@users.noreply.github.com>
What is authentik?
authentik is an open-source Identity Provider (IdP) for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters.
Our enterprise offering is available for organizations to securely replace existing IdPs such as Okta, Auth0, Entra ID, and Ping Identity for robust, large-scale identity management.
Installation
- Docker Compose: recommended for small/test setups. See the documentation.
- Kubernetes (Helm Chart): recommended for larger setups. See the documentation and the Helm chart repository.
- AWS CloudFormation: deploy on AWS using our official templates. See the documentation.
- DigitalOcean Marketplace: one-click deployment via the official Marketplace app. See the app listing.
Screenshots
| Light | Dark |
|---|---|
 |
 |
 |
 |
Development and contributions
See the Developer Documentation for information about setting up local build environments, testing your contributions, and our contribution process.
When you contribute documentation, either to accompany a code change or as a standalone contribution, please be sure to follow our documentation Style Guide.
Security
Please see SECURITY.md.
Adoption
Using authentik? We'd love to hear your story and feature your logo. Email us at hello@goauthentik.io or open a GitHub Issue/PR!
License
