[zaniebot]

Add key-value-store/get, key-value-store/put, and key-value-store/delete to share small values within a GitHub Actions OIDC context. Each invocation exchanges a fresh OIDC token for a short-lived session. The service assigns separate namespaces to different pull requests; workflows for the same pull request and environment can share keys.

All three actions take service-url, key, and an optional audience, and require id-token: write. put accepts UTF-8 text through value or raw bytes through path, up to 64 KiB. get returns found, value, path, and expires-at; a missing key succeeds with found: 'false', while an empty value has found: 'true'. When get writes to path, the file must not already exist. Deleting an absent key succeeds.

Namespace isolation is enforced by the service. All actors and jobs within one accepted OIDC context share read, write, and delete access, and anyone holding a session token can use it until expiry. OIDC and session tokens are not action outputs, redirects are rejected, and retrieved text is masked by default. The service endpoint, audience, and file paths must be trusted, including the parent directories of file paths; retrieved values remain untrusted data.

The README includes usage examples and documents the action inputs, outputs, and service API.