From 5242a57ac4e01544ed59f4da9dc79a37b601b233 Mon Sep 17 00:00:00 2001 From: Roch Devost Date: Thu, 4 Jun 2026 17:24:22 -0400 Subject: [PATCH] fix: use dd-octo-sts for release workflow authentication GITHUB_TOKEN write access is disabled org-wide; switch to dd-octo-sts to obtain a scoped token with contents:write for tag push events. Co-Authored-By: Claude Sonnet 4.6 --- .../self.release.create-release.sts.yaml | 10 ++++++++++ .github/workflows/release.yml | 18 ++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 .github/chainguard/self.release.create-release.sts.yaml diff --git a/.github/chainguard/self.release.create-release.sts.yaml b/.github/chainguard/self.release.create-release.sts.yaml new file mode 100644 index 0000000..97173d3 --- /dev/null +++ b/.github/chainguard/self.release.create-release.sts.yaml @@ -0,0 +1,10 @@ +issuer: https://token.actions.githubusercontent.com + +subject_pattern: "repo:DataDog/sirun:ref:refs/tags/v.*" + +claim_pattern: + event_name: "push" + job_workflow_ref: DataDog/sirun/\.github/workflows/release\.yml@refs/tags/v.* + +permissions: + contents: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d7816ff..74dfbad 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,11 +6,18 @@ on: jobs: create-release: runs-on: ubuntu-latest + permissions: + id-token: write steps: + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + id: octo-sts + with: + scope: DataDog/sirun + policy: self.release.create-release - uses: actions/checkout@v2 - uses: taiki-e/create-gh-release-action@v1 env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} upload-assets: strategy: matrix: @@ -22,7 +29,14 @@ jobs: - target: aarch64-apple-darwin os: macos-latest runs-on: ${{ matrix.os || 'ubuntu-latest'}} + permissions: + id-token: write steps: + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + id: octo-sts + with: + scope: DataDog/sirun + policy: self.release.create-release - uses: actions/checkout@v2 - uses: taiki-e/upload-rust-binary-action@v1 with: @@ -30,5 +44,5 @@ jobs: target: ${{ matrix.target }} archive: $bin-$tag-$target env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} CARGO_PROFILE_RELEASE_LTO: true