updating oidc information

content/en/certificate_authority/oidc-in-fulcio.md

@@ -19,16 +19,32 @@
 Email-based OIDC providers use the user's email as the subject of the certificate.
 
 * Dex (`oauth2.sigstore.dev/auth`)
     * GitHub (Note that this is the email of the user, not the GitHub username)
     * Google
     * Microsoft
 * Google (`accounts.google.com`)
 
 ### Source repository
 
+#### GitHub
+
 GitHub supports OIDC tokens for its workflows initiated from GitHub Actions. This removes the need for persisting authentication credentials. OIDC tokens include information about the workflow and source repository.
 
-* GitHub Actions (`token.actions.githubusercontent.com`)
+You must include the proper permissions in your workflow to use an OIDC token.
+
+```yaml
+permissions:
+    id-token: write
+```
+
+When verifying a signature generated through a workflow on GitHub, you can expect the following values:
+
+* **certificate-oidc-issuer**: https://token.actions.githubusercontent.com
+* **certificate-identity**: https://github.com/USERNAME/REPOSITORY_NAME/.github/workflows/WORKFLOW_NAME@refs/heads/BRANCH_NAME
+
+Sigstore currently offers two different GitHub Actions ([`cosign-installer`](https://github.com/marketplace/actions/cosign-installer) and [`gh-action-sigstore-installer`](https://github.com/sigstore/gh-action-sigstore-python)) to help you easily integrate Sigstore into your workflows. You can learn more about them in our [CI Quickstart]({{< relref "quickstart/quickstart-ci">}})
+
+#### GitLab
 
 GitLab supports OIDC tokens for its workflows initiated from GitLab CI/CD pipelines. This removes the need for persisting authentication credentials. OIDC tokens include information about the workflow and source repository.
 
@@ -69,7 +85,7 @@
 
 For example, `iss` could be `https://oauth2.sigstore.dev/auth` or `https://token.actions.githubusercontent.com`.
 
 ```
 {
     "aud": "sigstore"
     "iss": "<uri>"
@@ -84,7 +100,7 @@
 
 In addition to the standard JWT claims, the token must include the following claims:
 
 ```
 {
     "email_verified": true
     "email": "[email protected]"
@@ -97,7 +113,7 @@
 
 The token must include the following claims:
 
 ```
 {
     "job_workflow_ref": "octo-org/octo-automation/.github/workflows/oidc.yml@refs/heads/main"
     "sha": "example-sha",
@@ -143,7 +159,7 @@
 
 The token must include the following claims:
 
 ```
 {
     "sub": "spiffe://foo.example.com"
 }
@@ -159,11 +175,11 @@
 
 The token must include the following claims:
 
 ```
 {
     "kubernetes.io": {
 	    "namespace": "default",
 	    "pod": {
 	        "name": "oidc-test",
 	        "uid": "49ad3572-b3dd-43a6-8d77-5858d3660275"
 	    },