Repository navigation
Add Octo STS trust policies for warp-server, channel-versions and warp-internal - #960
Merged
Merged
Conversation
…p-internal Co-Authored-By: Warp <agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
bnavetta
approved these changes
Oct 27, 2026
Match the job_workflow_ref claim so only the workflow file that is meant to use each identity can federate, not any workflow on the allowed refs. Co-Authored-By: Warp <agent@warp.dev>
bnavetta
approved these changes
Oct 27, 2026
harryalbert
added a commit
to warpdotdev/warp
that referenced
this pull request
Oct 28, 2026
## Description Replaces the `warpmachineuser` PATs `CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN` and `DOCS_REPOSITORY_DISPATCH_TOKEN` with short-lived tokens minted by [Octo STS](https://github.com/octo-sts/app) (`octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1`). The job's Actions OIDC token is exchanged for a token scoped to the target repo; no App private key, variable, or secret is involved. The action revokes each token when the job ends. ### Octo STS identities | Identity | Scope | Subject | Permissions | Policy | |---|---|---|---|---| | `warp-internal-dispatch` | `warpdotdev/channel-versions` | `repo:warpdotdev/warp-internal:ref:refs/heads/(master\|[a-z]+_release/.+)` | `contents: write` (required for `repository_dispatch`) | warpdotdev/channel-versions#1037 | | `warp-internal-dispatch` | `warpdotdev/docs` | `repo:warpdotdev/warp-internal:ref:refs/heads/master` | `contents: write` (required for `repository_dispatch`) | warpdotdev/docs#960 | - `cut_new_releases.yml` runs on `master` (schedule / `workflow_dispatch`); `cut_new_release_candidate.yml` is dispatched on `<channel>_release/*` branches. Both `update_channel_versions` jobs gain `id-token: write`. - `notify-docs-settings-changed.yml` runs on `master` pushes; the `dispatch` job gains `id-token: write`. ### Other changes - The `dispatch` job in `notify-docs-settings-changed.yml` keeps `if: github.repository == 'warpdotdev/warp-internal'`. repo-sync copies these workflows to public `warp`; the `octo-sts/action` steps are harmless there, but the trust policies name `warp-internal` subjects, so `warp`-sourced runs would be rejected. `Cut New Releases` / `Cut New Release Candidate` are disabled in `warp`. ### Human prerequisites (before merge) - The Octo STS App is installed on `channel-versions` and `docs`. - The `warp-internal-dispatch` policies are merged to the default branches of channel-versions and docs. ### Post-merge verification - The next `Cut New Releases` or `Cut New Release Candidate` run: the `update_channel_versions` job passes and the `repository_dispatch` run in channel-versions shows `octo-sts[bot]` as `triggering_actor`. - The next merge touching `app/src/settings_view/**`: `notify-docs-settings-changed` passes in warp-internal and is skipped in warp; the docs dispatch run shows `octo-sts[bot]` as `triggering_actor`. - Then delete `CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN` and `DOCS_REPOSITORY_DISPATCH_TOKEN`. ## Testing - `actionlint` on the 3 changed files: no new findings (the pre-existing shellcheck findings in untouched `run:` blocks are unchanged vs `master`). - I did not run the workflows: the trust policies are not on the target default branches yet. --- _Opened from patches authored by @captainsafia._ CHANGELOG-NONE Co-Authored-By: Warp <agent@warp.dev> --------- Co-authored-by: Safia Abdalla <safia@safia.rocks> Co-authored-by: Warp <agent@warp.dev>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds three Octo STS trust policies under
.github/chainguard/:warp-server-docs-syncrepo:warpdotdev/warp-server:ref:refs/heads/(develop|release/[^:]+)sync_public_openapi_to_docs.ymlpublish job (https://github.com/warpdotdev/warp-server/pull/20761): pushesautomation/sync-agent-api-specand opens/updates the docs PR. Runs viadeploy_release_candidate.yml(workflow_dispatch, ondevelopor arelease/*branch) or directworkflow_dispatch.channel-versions-dispatchrepo:warpdotdev/channel-versions:ref:refs/heads/mainupdate_channels.ymlupdate_docsjob (https://github.com/warpdotdev/channel-versions/pull/1037):repository_dispatchinto this repo.warp-internal-dispatchrepo:warpdotdev/warp-internal:ref:refs/heads/masternotify-docs-settings-changed.yml(warpdotdev/warp#16655):repository_dispatchinto this repo.CI on the source workflow cannot pass until this policy is on this repo's default branch and the octo-sts installation covers this repo.
CHANGELOG-NONE
Co-Authored-By: Warp agent@warp.dev