Document immutable subject claims for GitHub Actions OIDC tokens

[paulSambolin]

Why:

GitHub Actions OIDC tokens now include immutable numeric IDs for the repository owner and repository in the default sub claim, protecting against attacks that rely on recycling repository or organization names. This is enabled by default for repositories created or renamed on or after July 15, 2026.

This behavior is not yet documented in the OpenID Connect concepts page. See the changelog: https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/

What's being changed (if available, include any code snippets, screenshots, or gifs):

Adds an Immutable subject claims subsection under "Understanding the OIDC token" in content/actions/concepts/security/openid-connect.md. The new content:

• Explains that the default sub claim now embeds immutable owner and repository IDs, appended to each name with an @ delimiter (e.g. repo:octocat@123456/my-repo@456789:ref:refs/heads/main), and contrasts it with the earlier name-only format.
• Notes the default-on date (July 15, 2026) and that admins can opt existing repositories in earlier via the Actions OIDC settings UI or REST API.
• Advises updating cloud provider trust conditions to match the new subject format, and mentions previewing the new subject claim prefix beforehand.

The section is wrapped in {% ifversion fpt or ghec %} because the changelog states the change applies to GitHub.com only and does not affect GitHub Enterprise Server.

Check off the following:

• I have reviewed my changes in staging, available via the View deployment link in this PR's timeline (this link will be available after opening the PR).
• For content changes, I have completed the self-review checklist.

Generated with Claude Code

[welcome]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
actions/concepts/security/openid-connect.md	fpt ghec ghes@ 3.21 3.20 3.19 3.18 3.17	fpt ghec ghes@ 3.21 3.20 3.19 3.18 3.17

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

Pull request overview

Documents immutable OIDC subject claims for GitHub Actions.

Changes:

• Explains the immutable subject format and security benefits.
• Describes rollout, opt-in, preview, and trust-policy updates.

[jlconnor]

LGTM