From 56b685341ef9698ca758450aff2be871837a6919 Mon Sep 17 00:00:00 2001 From: Kai Date: Wed, 22 Jul 2026 20:17:38 +0000 Subject: [PATCH] feat: add libraries-gen Octo STS policies Signed-off-by: Kai --- .../dev-klrmngr-libraries-gen.sts.yaml | 21 +++++++++++++++++++ .../chainguard/staging-libraries-gen.sts.yaml | 21 +++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 .github/chainguard/dev-klrmngr-libraries-gen.sts.yaml create mode 100644 .github/chainguard/staging-libraries-gen.sts.yaml diff --git a/.github/chainguard/dev-klrmngr-libraries-gen.sts.yaml b/.github/chainguard/dev-klrmngr-libraries-gen.sts.yaml new file mode 100644 index 0000000..01b7834 --- /dev/null +++ b/.github/chainguard/dev-klrmngr-libraries-gen.sts.yaml @@ -0,0 +1,21 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Octo STS policy for Kaiming's libraries-gen dev environment. +# Service account: klrmngr-libraries-gen@klrmngr-dev.iam.gserviceaccount.com + +issuer: https://accounts.google.com +# Replace after env/dev/klrmngr/400-libraries-gen creates the service account: +# terraform output service_account_unique_id +subject: "TODO" + +permissions: + actions: read + checks: read + contents: write + pull_requests: write + issues: write + workflows: write + +repositories: + - ecosystems-packages diff --git a/.github/chainguard/staging-libraries-gen.sts.yaml b/.github/chainguard/staging-libraries-gen.sts.yaml new file mode 100644 index 0000000..3f9adb7 --- /dev/null +++ b/.github/chainguard/staging-libraries-gen.sts.yaml @@ -0,0 +1,21 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Octo STS policy for libraries-gen staging environment. +# Service account: libraries-gen@staging-enforce-cd1e.iam.gserviceaccount.com + +issuer: https://accounts.google.com +# Replace after env/chainops.dev/iac/400-libraries-gen creates the service +# account: terraform output service_account_unique_id +subject: "TODO" + +permissions: + actions: read + checks: read + contents: write + pull_requests: write + issues: write + workflows: write + +repositories: + - ecosystems-packages