From e1b7420ef0c0bac5d6543cd61785c9190b45bca7 Mon Sep 17 00:00:00 2001 From: Jeremy Drouillard Date: Fri, 23 Oct 2026 13:33:03 -0700 Subject: [PATCH] Add OctoSTS org trust policy for SEP tech debt project sync --- .../chainguard/sep-tech-debt-sync.sts.yaml | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/chainguard/sep-tech-debt-sync.sts.yaml diff --git a/.github/chainguard/sep-tech-debt-sync.sts.yaml b/.github/chainguard/sep-tech-debt-sync.sts.yaml new file mode 100644 index 0000000..22baa50 --- /dev/null +++ b/.github/chainguard/sep-tech-debt-sync.sts.yaml @@ -0,0 +1,29 @@ +# SEP's tech debt sync copies issue form ratings into Stacklok project 74's +# Debt fields. GITHUB_TOKEN cannot write org projects, so the workflow +# exchanges its Actions OIDC token here. It requests scope "stacklok" and +# identity "sep-tech-debt-sync". +# SEP source: stacklok/stacklok-enterprise-platform +# .github/workflows/bot-tech-debt-project-sync.yml. +issuer: https://token.actions.githubusercontent.com +subject: repo:stacklok/stacklok-enterprise-platform:ref:refs/heads/main + +# workflow_ref identifies the standalone workflow, including its branch. +# OctoSTS anchors the expression to the entire claim value. +claim_pattern: + repository_id: '1173448377' + repository_owner_id: '110237746' + workflow_ref: stacklok/stacklok-enterprise-platform/\.github/workflows/bot-tech-debt-project-sync\.yml@refs/heads/main + +# Pin token exchanges to stacklok-octosts. The App ID is a string. +app: '4886385' + +# Install stacklok-octosts on each repo in this list. The workflow reads the +# issue it adds to the project. +repositories: + - stacklok-enterprise-platform + +# organization_projects covers every org project; the workflow writes only +# project 74. +permissions: + organization_projects: write + issues: read