From d0946858ee5c97f1528e3205a5e5cda81bb3e824 Mon Sep 17 00:00:00 2001 From: Harry Albert Date: Mon, 26 Oct 2026 19:55:22 -0400 Subject: [PATCH 1/2] Add Octo STS trust policies for warp-server, channel-versions and warp-internal Co-Authored-By: Warp --- .github/chainguard/channel-versions-dispatch.sts.yaml | 4 ++++ .github/chainguard/warp-internal-dispatch.sts.yaml | 4 ++++ .github/chainguard/warp-server-docs-sync.sts.yaml | 5 +++++ 3 files changed, 13 insertions(+) create mode 100644 .github/chainguard/channel-versions-dispatch.sts.yaml create mode 100644 .github/chainguard/warp-internal-dispatch.sts.yaml create mode 100644 .github/chainguard/warp-server-docs-sync.sts.yaml diff --git a/.github/chainguard/channel-versions-dispatch.sts.yaml b/.github/chainguard/channel-versions-dispatch.sts.yaml new file mode 100644 index 000000000..01853d0c5 --- /dev/null +++ b/.github/chainguard/channel-versions-dispatch.sts.yaml @@ -0,0 +1,4 @@ +issuer: https://token.actions.githubusercontent.com +subject: repo:warpdotdev/channel-versions:ref:refs/heads/main +permissions: + contents: write diff --git a/.github/chainguard/warp-internal-dispatch.sts.yaml b/.github/chainguard/warp-internal-dispatch.sts.yaml new file mode 100644 index 000000000..875ff37de --- /dev/null +++ b/.github/chainguard/warp-internal-dispatch.sts.yaml @@ -0,0 +1,4 @@ +issuer: https://token.actions.githubusercontent.com +subject: repo:warpdotdev/warp-internal:ref:refs/heads/master +permissions: + contents: write diff --git a/.github/chainguard/warp-server-docs-sync.sts.yaml b/.github/chainguard/warp-server-docs-sync.sts.yaml new file mode 100644 index 000000000..504d68775 --- /dev/null +++ b/.github/chainguard/warp-server-docs-sync.sts.yaml @@ -0,0 +1,5 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: repo:warpdotdev/warp-server:ref:refs/heads/(develop|release/[^:]+) +permissions: + contents: write + pull_requests: write From ca37e503710ddfaecb26af8a2300de34c8c94ca5 Mon Sep 17 00:00:00 2001 From: harryalbert Date: Tue, 27 Oct 2026 09:35:29 -0400 Subject: [PATCH 2/2] Restrict Octo STS trust policies to their minting workflow Match the job_workflow_ref claim so only the workflow file that is meant to use each identity can federate, not any workflow on the allowed refs. Co-Authored-By: Warp --- .github/chainguard/channel-versions-dispatch.sts.yaml | 2 ++ .github/chainguard/warp-internal-dispatch.sts.yaml | 2 ++ .github/chainguard/warp-server-docs-sync.sts.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/.github/chainguard/channel-versions-dispatch.sts.yaml b/.github/chainguard/channel-versions-dispatch.sts.yaml index 01853d0c5..875c53bbf 100644 --- a/.github/chainguard/channel-versions-dispatch.sts.yaml +++ b/.github/chainguard/channel-versions-dispatch.sts.yaml @@ -1,4 +1,6 @@ issuer: https://token.actions.githubusercontent.com subject: repo:warpdotdev/channel-versions:ref:refs/heads/main +claim_pattern: + job_workflow_ref: warpdotdev/channel-versions/\.github/workflows/update_channels\.yml@refs/heads/main permissions: contents: write diff --git a/.github/chainguard/warp-internal-dispatch.sts.yaml b/.github/chainguard/warp-internal-dispatch.sts.yaml index 875ff37de..449bec81e 100644 --- a/.github/chainguard/warp-internal-dispatch.sts.yaml +++ b/.github/chainguard/warp-internal-dispatch.sts.yaml @@ -1,4 +1,6 @@ issuer: https://token.actions.githubusercontent.com subject: repo:warpdotdev/warp-internal:ref:refs/heads/master +claim_pattern: + job_workflow_ref: warpdotdev/warp-internal/\.github/workflows/notify-docs-settings-changed\.yml@refs/heads/master permissions: contents: write diff --git a/.github/chainguard/warp-server-docs-sync.sts.yaml b/.github/chainguard/warp-server-docs-sync.sts.yaml index 504d68775..546a0831c 100644 --- a/.github/chainguard/warp-server-docs-sync.sts.yaml +++ b/.github/chainguard/warp-server-docs-sync.sts.yaml @@ -1,5 +1,7 @@ issuer: https://token.actions.githubusercontent.com subject_pattern: repo:warpdotdev/warp-server:ref:refs/heads/(develop|release/[^:]+) +claim_pattern: + job_workflow_ref: warpdotdev/warp-server/\.github/workflows/sync_public_openapi_to_docs\.yml@refs/heads/(develop|release/.+) permissions: contents: write pull_requests: write