Repository navigation
Add a token policy for rate card publication - #100
Conversation
Lets only DataDog/trajectory's protected ratecard-publish workflow on main get a short-lived token with contents: write, to update the generated files on the ratecards branch.
![datadog-official[bot]](https://avatars.githubusercontent.com/in/1358509?s=60&v=4){kind=small}
There was a problem hiding this comment.
The ref_protected claim is not included in GitHub Actions OIDC tokens, so requiring it in the STS policy will reject token exchange and block rate-card publication even for the intended protected-branch workflow. Branch protection should be enforced via repository or environment rules instead.
🤖 Bits Code Review · Commit 9faaa8e
| claim_pattern: | ||
| event_name: (push|workflow_dispatch) | ||
| ref: refs/heads/main | ||
| ref_protected: "true" |
There was a problem hiding this comment.
GitHub Actions OIDC tokens do not include ref_protected; it is a workflow-context property. Requiring this claim causes dd-octo-sts to reject even the intended publication job on protected main, preventing token acquisition and rate card publication. Remove this requirement and enforce branch protection through repository or environment rules.
| ref_protected: "true" |
React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it
What each reaction means
- 👍 Useful: correct, and you're fixing it or will.
- 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
- 😕 Unclear: you can't tell what it means or why it matters.
- 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.
🤖 Bits Code Review · Open Bits AI session
There was a problem hiding this comment.
Keeping it: GitHub Actions OIDC tokens do carry a ref_protected claim, and dd-octo-sts matches it. For example, DataDog/dd-trace-py's .github/chainguard/self.update-system-tests.create-pr.sts.yaml requires ref_protected: "true", and its scheduled run 39437219812 on 2026-10-20 minted a token with that policy through DataDog/dd-octo-sts-action. DataDog/dd-trace-java's self.update-gradle-dependencies.create-pr policy requires it too.
Adds a dd-octo-sts trust policy that lets one workflow, DataDog/trajectory's
ratecard-publish.ymlrunning from protectedmainin theratecard-publicationenvironment, get a short-lived token withcontents: writefor this repository. The workflow will keep generated rate card files on a separateratecardsbranch; it does not open pull requests or changemain.