From 46b53c9142a8dd16ec850ec473dbf7a56cabea0b Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Thu, 20 Aug 2026 22:45:46 -0700 Subject: [PATCH] chore: add GitHub STS trust policy for Slack config rotation --- .github/sts/slack-config.sts.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/sts/slack-config.sts.yaml diff --git a/.github/sts/slack-config.sts.yaml b/.github/sts/slack-config.sts.yaml new file mode 100644 index 0000000..ef6031f --- /dev/null +++ b/.github/sts/slack-config.sts.yaml @@ -0,0 +1,14 @@ +# Lets this repository's workflows mint a short-lived token that can write +# repository Actions secrets, so setup-slack-config-token can persist the +# rotated SLACK_CONFIG_REFRESH_TOKEN after calling Slack's tooling.tokens.rotate +# (rotation invalidates the previous refresh token, so the new one must be +# stored immediately). Replaces the SLACK_GH_TOKEN fine-grained PAT. +# +# refs/heads/main covers the production deploy and the scheduled preview sweep; +# pull_request covers preview deploy/destroy runs. +subject: + - repo:tempoxyz@211589300/tip.bot@1232143975:ref:refs/heads/main + - repo:tempoxyz@211589300/tip.bot@1232143975:pull_request + +permissions: + secrets: write