From a450aa109cec7ced2c03caee3ed2b76ab5f40564 Mon Sep 17 00:00:00 2001 From: Nashon Steffen Date: Thu, 8 Oct 2026 09:54:12 -0700 Subject: [PATCH] Add OctoSTS org trust policy for toolhive-doc-mcp refresh The toolhive-doc-mcp refresh CronJob reads docs from toolhive, toolhive-studio, and toolhive-catalog. It exchanges an EKS service account token for a read-only GitHub App token. This replaces an expired PAT. Add a CODEOWNERS entry for .github/chainguard/. Org policies in this repo can mint tokens for any repo where stacklok-octosts is installed. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../chainguard/toolhive-doc-refresh.sts.yaml | 20 +++++++++++++++++++ CODEOWNERS | 3 +++ 2 files changed, 23 insertions(+) create mode 100644 .github/chainguard/toolhive-doc-refresh.sts.yaml diff --git a/.github/chainguard/toolhive-doc-refresh.sts.yaml b/.github/chainguard/toolhive-doc-refresh.sts.yaml new file mode 100644 index 0000000..878e5e3 --- /dev/null +++ b/.github/chainguard/toolhive-doc-refresh.sts.yaml @@ -0,0 +1,20 @@ +# The toolhive-doc-mcp refresh CronJob reads docs from three public repos. +# The token only raises the GitHub API rate limit. It grants no write access. +# The CronJob requests scope "stacklok" and identity "toolhive-doc-refresh". +# Infra source: stacklok/infra flux/apps/toolhive-doc-mcp/cronjob.yaml. + +# EKS cluster OIDC issuers: dev-eks, staging-eks, production-eks. +issuer_pattern: https://oidc\.eks\.us-east-1\.amazonaws\.com/id/(2B9CEB1C9C82A9475C828FA05327FA3B|5C4FEA4B26456FC60713BE9416A0FEC6|AE64839E8B984F745739BBF77BB0E457) +subject: system:serviceaccount:toolhive-doc-mcp:toolhive-doc-refresh + +# Pin token exchanges to stacklok-octosts. The App ID is a string. +app: '4886385' + +# Install stacklok-octosts on each repo in this list. +repositories: + - toolhive + - toolhive-studio + - toolhive-catalog + +permissions: + contents: read diff --git a/CODEOWNERS b/CODEOWNERS index 217df88..42b511b 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,3 +1,6 @@ # Workflow changes require maintainer review /.github/workflows/ @stacklok/maintain + +# OctoSTS org trust policies mint GitHub tokens for org repos +/.github/chainguard/ @stacklok/maintain