[harryalbert]

Summary

Client releases have failed every day since 10/26 because create_release.yml depends on three stored credentials that no longer work. This replaces all of them with per-run OIDC federation, so there's nothing left to rotate.

• WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY (dead SSH key; every build job fails at compile time because script/install_channel_config can't clone warp-channel-config): prepare_environment now takes install_channel_config: true instead of ssh_key, mints a contents: read token for warpdotdev/warp-channel-config via Octo STS, rewrites the SSH URL to HTTPS with that token, and sets CARGO_NET_GIT_FETCH_WITH_CLI=true so cargo install --git honors the rewrite. Only runs in warpdotdev/warp-internal; elsewhere the install still falls back gracefully.
• GOOGLE_APPLICATION_CREDENTIALS (service-account JSON key, deleted; all 15 GCS uploads and the Linux PGP key fetch fail with invalid_grant): every google-github-actions/auth step now uses workload_identity_provider + service_account: github-actions@astral-field-294621 through the shared GitHub Actions WIF pool.
• GH_APP_CREDENTIALS_TOKEN (suspended App; legacy non-stable changelog): replaced with an Octo STS token (release-changelog, contents: read + pull_requests: read on warp-internal). Policy added at .github/chainguard/release-changelog.sts.yaml.
• id-token: write added at the workflow level in create_release.yml and on the calling jobs in cut_new_releases.yml / cut_new_release_candidate.yml (a reusable-workflow caller must grant what the callee declares).

Stacked on #16655 (which already touches the two cut workflows).

Prerequisites (before merge)

1. warpdotdev/warp-terraform#1718 applied — grants the warp-internal WIF principal workloadIdentityUser on the release SA.
2. warpdotdev/warp-channel-config#8 merged, and the octo-sts App installed on warp-channel-config.
3. This PR's repo-sync lands in warp-internal (the release-changelog policy and the workflow changes both need to be on warp-internal master).

Verification

• After merge: trigger Create Release via workflow_dispatch for dev (no publish) — every build job must get past Install dependencies with the channel config installed.
• The next scheduled Cut New Releases must upload to warp-releases/… and fetch the PGP key without invalid_grant.
• Then delete WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY, GOOGLE_APPLICATION_CREDENTIALS, and GH_APP_CREDENTIALS_TOKEN from warp-internal.

Not covered here

ACTION_MONITORING_SLACK (account_inactive) still needs a new Slack bot token — it's why nobody was paged about the failing releases.

CHANGELOG-NONE

Co-Authored-By: Warp agent@warp.dev

[harryalbert]

• Release workflow: federate to GCP and Octo STS instead of stored keys #16674 👈 (View in Graphite)
• ci: mint GitHub App tokens instead of warpmachineuser PATs #16655
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.