Document GitHub immutable subject claims for assumable identities#3616
Merged
matthewhelmke merged 3 commits intoJul 22, 2026
Merged
Conversation
GitHub now embeds immutable numeric owner and repository IDs in the OIDC token subject claim (repo:org@<owner-id>/repo@<repo-id>:...). This format is the default for repositories created after 2026-07-15 and an opt-in for older ones. An identity that matches the old name-only subject will not match a token that carries the immutable subject, so the workflow fails to authenticate. Update the GitHub Actions identity guide (the source of truth), the Octo STS FAQ, and the registry-authentication and Renovate guides to use and explain the new format, including how to find the numeric IDs. The Custom Assembly GitOps guide matches on the repository claim, which is unaffected by this change, so note that and add optional repository_id hardening guidance. Refs: DOCS-73 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
✅ Deploy Preview for ornate-narwhal-088216 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
matthewhelmke
added a commit
to matthewhelmke/edu
that referenced
this pull request
Jul 21, 2026
Update the OIDC subject claim in the identity and role-binding examples to GitHub's immutable format (repo:org@<owner-id>/repo@<repo-id>:...). This keeps the tutorial consistent with the broader docs update in chainguard-dev#3616, which explains the format and how to find the numeric IDs. Refs: DOCS-73 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9 tasks
matthewhelmke
marked this pull request as draft
July 21, 2026 15:17
Collaborator
Author
|
I have tested all of the code in this docs update. |
matthewhelmke
marked this pull request as ready for review
July 21, 2026 17:11
ribbybibby
reviewed
Jul 22, 2026
s-stumbo
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub now embeds immutable numeric owner and repository IDs in the OIDC token subject claim —
repo:org@<owner-id>/repo@<repo-id>:...instead ofrepo:org/repo:.... This format is the default for repositories created after July 15, 2026, and an opt-in for older ones. An identity that matches the old name-only subject will not match a token that carries the immutable subject, so the workflow fails to authenticate.Reported by a solution architect in DOCS-73 after a customer (Aleph Alpha) hit it. See GitHub's changelog.
Changes
gh apilookup and token-log verification), and updates thechainctland Terraform examples.--github-repocommand and its subject note.--github-repocommand.repositoryclaim, which is unaffected by the change. Added a note explaining that, plus optionalrepository_idhardening guidance.The auto-generated
chainctlCLI reference still shows the old format. It regenerates from the CLI source, so it needs a separate fix in the CLI repo rather than a manual edit here.Before merge — verify against a live org
These use
chainctlin ways I could not test from the docs repo:chainctl iam identities create github … --github-repo=my-org@<owner-id>/repo-name@<repo-id>is accepted and produces the immutable subject.--github-ref(not--github-refs) is the correct flag for the multi-branch regex example.--claim=repository_id=<repo-id>is a valid claim key (the optional hardening in the Custom Assembly guide).Created in collaboration with Claude Code running Opus 4.8 on 2026-07-21.