[jerm-dro]

Summary

• Adds .github/chainguard/sep-tech-debt-sync.sts.yaml, an org-level OctoSTS trust policy for SEP's tech debt project sync.

SEP is adding a Tech debt issue form. Issue forms can't set project custom fields, so a workflow (bot-tech-debt-project-sync.yml) copies the form's ratings into the Debt fields on Stacklok project 74. GITHUB_TOKEN can't write org projects, so the workflow exchanges its Actions OIDC token here for a stacklok-octosts token instead of using a stored GitHub App key. This follows SEP's existing publish-docs-references.yml setup.

The policy accepts exactly one caller. That caller must:

• come from the GitHub Actions issuer
• have the subject repo:stacklok/stacklok-enterprise-platform:ref:refs/heads/main
• match the pinned repository and owner IDs
• run the workflow bot-tech-debt-project-sync.yml@refs/heads/main

The token carries organization_projects: write plus issues: read on stacklok-enterprise-platform.

The SEP side is stacklok/stacklok-enterprise-platform#5584, "feat(github): add tech debt issue form and project field sync".

Prerequisites (org admin)

• Install stacklok-octosts on stacklok-enterprise-platform, if it isn't already installed. GitHub rejects the token request if the policy lists a repo outside the installation.

Security note

organization_projects: write can't be narrowed to a single project, so the minted token can write any org project. The workflow only writes project 74, and the policy limits minting to that one workflow file on SEP's main. Changing that workflow needs a reviewed PR to SEP's main. A dedicated GitHub App would carry the same org-wide project scope.

Validation

• The repository ID (1173448377) and owner ID (110237746) were checked against the GitHub API, and they match SEP's existing sep-docs-pr policy in docs-website.
• The stacklok-octosts app's permissions include organization_projects: write and issues: write, so both requested permissions are within its grant.
• After this merges and SEP#5584 lands, filing a test Tech debt issue confirms the real token mint and field writes.

🤖 Generated with Claude Code

[github-actions]

Missing Issue Link

This PR does not appear to reference a GitHub issue.
Please add a closing keyword (e.g. Closes #123) if this PR fully resolves the issue, or a non-closing reference (e.g. Part of #123) if it's one of several PRs implementing it.
Cross-repo references are also supported (e.g. Part of owner/repo#123) for issues tracked outside this repository.
Supported closing keywords: closes, fixes, resolves, close, fix, resolve (case insensitive)
Supported non-closing references: relates to, related to, part of, refs, ref, references, reference, contributes to, follow-up to (case insensitive)
Note: closing keywords only auto-close issues in this repository — cross-repo references never auto-close, regardless of keyword.