From e86e48723aafc781ff5f70bc9bb34b4a2ddab90d Mon Sep 17 00:00:00 2001 From: Steve Beattie Date: Mon, 19 Oct 2026 13:12:16 -0700 Subject: [PATCH] octo-sts: authorize the gha-db-sync sweep SA to obtain read-only tokens Adds an octo-sts trust policy so octo-sts will issue org-scoped, read-only GitHub tokens to the security-lake gha-db-sync Cloud Run SA (the gha-supply-chain Actions-usage/graph ingester) when it sweeps this org. PSEC-3243. Co-Authored-By: Claude Opus 4.8 --- .github/chainguard/gha-sweep.sts.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .github/chainguard/gha-sweep.sts.yaml diff --git a/.github/chainguard/gha-sweep.sts.yaml b/.github/chainguard/gha-sweep.sts.yaml new file mode 100644 index 0000000..7210b49 --- /dev/null +++ b/.github/chainguard/gha-sweep.sts.yaml @@ -0,0 +1,7 @@ +issuer: https://accounts.google.com +# subject = unique ID of gha-db-sync@security-lake.iam.gserviceaccount.com +# (the gha-supply-chain ingester's Cloud Run SA; terraform output sweep_sa_unique_id) +subject: "105279350470920492145" +permissions: + contents: read + metadata: read