From 44575ac6e5d25de729e3e02185e1defedc225043 Mon Sep 17 00:00:00 2001 From: harryalbert Date: Mon, 26 Oct 2026 20:12:14 -0400 Subject: [PATCH 1/2] Add Octo STS trust policy channel-versions-read Lets channel-versions workflows read this repository's releases and contents via Octo STS instead of a GitHub App installation token. Co-Authored-By: Warp --- .github/chainguard/channel-versions-read.sts.yaml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .github/chainguard/channel-versions-read.sts.yaml diff --git a/.github/chainguard/channel-versions-read.sts.yaml b/.github/chainguard/channel-versions-read.sts.yaml new file mode 100644 index 00000000000..3acbd83b35a --- /dev/null +++ b/.github/chainguard/channel-versions-read.sts.yaml @@ -0,0 +1,4 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: repo:warpdotdev/channel-versions:.* +permissions: + contents: read From 739e6a36d8a33e7c7862310acfe399f9f8e9e41f Mon Sep 17 00:00:00 2001 From: harryalbert Date: Tue, 27 Oct 2026 09:35:39 -0400 Subject: [PATCH 2/2] Restrict Octo STS trust policies to their minting workflow Match the job_workflow_ref claim so only the workflow file that is meant to use each identity can federate, not any workflow on the allowed refs. Co-Authored-By: Warp --- .github/chainguard/channel-versions-read.sts.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/chainguard/channel-versions-read.sts.yaml b/.github/chainguard/channel-versions-read.sts.yaml index 3acbd83b35a..3bcef2df6ef 100644 --- a/.github/chainguard/channel-versions-read.sts.yaml +++ b/.github/chainguard/channel-versions-read.sts.yaml @@ -1,4 +1,6 @@ issuer: https://token.actions.githubusercontent.com subject_pattern: repo:warpdotdev/channel-versions:.* +claim_pattern: + job_workflow_ref: warpdotdev/channel-versions/\.github/workflows/(update_channels|create_version_bump_pr)\.yml@.+ permissions: contents: read