From e8e60dbad68dfd1b14e34a1ed0c6c648bd059f55 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 5 Oct 2026 20:52:43 -0400
Subject: [PATCH] fix(ci): let the runner plan role read the Karpenter chart
 (#186)

The platform plan fetches a public ECR token. That call was only granted to the apply role.
---
 lib/actions-runner-hcptf-stack.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 4c3a6f5..db1988b 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -491,6 +491,18 @@ function planPolicy(hcpArn: string, githubArn: string): object {
         Action: ["kms:ListAliases", "ssm:DescribeParameters"],
         Resource: "*",
       },
+      {
+        Sid: "EcrPublicAuth",
+        Effect: "Allow",
+        Action: "ecr-public:GetAuthorizationToken",
+        Resource: "*",
+      },
+      {
+        Sid: "StsForPublicEcr",
+        Effect: "Allow",
+        Action: "sts:GetServiceBearerToken",
+        Resource: "*",
+      },
       {
         Sid: "EcrReads",
         Effect: "Allow",