chore: add GitHub STS trust policy for Slack config rotation - #77
Merged
Conversation
sds
force-pushed
the
sts-slack-config-policy
branch
from
August 21, 2026 06:00
f0bb0a5 to
46b53c9
Compare
sds
added a commit
that referenced
this pull request
Aug 21, 2026
Switches `setup-slack-config-token` from the `SLACK_GH_TOKEN` fine-grained PAT to a short-lived token minted through [github-sts](https://github.com/tempoxyz/github-sts) via `tempoxyz/gh-actions/actions/github-sts`, authorized by the `slack-config` trust policy added in #77. - The composite action now mints the GitHub token itself (only when rotation is actually needed, i.e. no access token was passed in), so the four calling workflows just drop the `github-token` input and gain `id-token: write`. - `SLACK_GH_TOKEN` plumbing is removed from `pull_request.yml` and the `preview_deploy.yml` `workflow_call` contract. - The minted token is scoped to this repo with `secrets: write`, and the STS action revokes it when the job completes. After merge, the `SLACK_GH_TOKEN` repository secret can be deleted and the PAT revoked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/sts/slack-config.sts.yaml, a github-sts trust policy that lets this repository's own workflows mint a short-lived token withsecrets: writeon this repository. Thesetup-slack-config-tokenaction needs that to persist the rotatedSLACK_CONFIG_REFRESH_TOKENafter calling Slack'stooling.tokens.rotate, which invalidates the previous refresh token.Subjects cover
refs/heads/main(production deploy, scheduled preview sweep) andpull_request(preview deploy/destroy) — the same runs that use theSLACK_GH_TOKENfine-grained PAT today.Policy only; a follow-up PR will switch the workflows to
tempoxyz/gh-actions/actions/github-stsand retireSLACK_GH_TOKEN.