adam/.github
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-09-30 08:13:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): match the default pull request OIDC subject (PLAT-234)

Browse source 
Trust refs/pull/* so seahaven-org-baseline pull request tokens can assume
the policy-check role. The immutable subject claim is not enabled.

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
This commit is contained in:
Cursor Agent 2026-09-28 16:17:41 +00:00
parent 7733c6c6d1
commit e497c5f347
No known key found for this signature in database
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
oidc-deploy-roles.yaml
View file

@ -1405,7 +1405,9 @@ Resources:
StringLike:
token.actions.githubusercontent.com:sub:
- !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
- !Sub repo:${GitHubOrg}/seahaven-org-baseline:pull_request
# use_immutable_subject is false, so pull_request tokens use
# repo:ORG/seahaven-org-baseline:ref:refs/pull/N/merge.
- !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/pull/*
Policies:
- PolicyName: access-analyzer-policy-check
PolicyDocument: