Skip to content

Add a token policy for rate card publication #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mr-lee merged 1 commit into from
Oct 22, 2026
Merged

Add a token policy for rate card publication #100

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/chainguard/trajectory.ratecard-publication.sts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Grants only the protected source rate card publication workflow a
# short-lived token to update the generated files on the ratecards branch.
issuer: https://token.actions.githubusercontent.com

subject: repo:DataDog/trajectory:environment:ratecard-publication

claim_pattern:
event_name: (push|workflow_dispatch)
ref: refs/heads/main
ref_protected: "true"

@datadog-official datadog-official Bot Oct 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Remove the unsupported ref_protected claim requirement

GitHub Actions OIDC tokens do not include ref_protected; it is a workflow-context property. Requiring this claim causes dd-octo-sts to reject even the intended publication job on protected main, preventing token acquisition and rate card publication. Remove this requirement and enforce branch protection through repository or environment rules.

Suggested change
ref_protected: "true"

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means
  • 👍 Useful: correct, and you're fixing it or will.
  • 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
  • 😕 Unclear: you can't tell what it means or why it matters.
  • 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

🤖 Bits Code Review · Open Bits AI session

@mr-lee mr-lee Oct 21, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping it: GitHub Actions OIDC tokens do carry a ref_protected claim, and dd-octo-sts matches it. For example, DataDog/dd-trace-py's .github/chainguard/self.update-system-tests.create-pr.sts.yaml requires ref_protected: "true", and its scheduled run 39437219812 on 2026-10-20 minted a token with that policy through DataDog/dd-octo-sts-action. DataDog/dd-trace-java's self.update-gradle-dependencies.create-pr policy requires it too.

repository: DataDog/trajectory
job_workflow_ref: DataDog/trajectory/\.github/workflows/ratecard-publish\.yml@refs/heads/main

permissions:
contents: write
Loading