feat: STS policy for fulfilled-bot (#68)

Related to chainguard-dev/mono#20235
chainguard-dev · Oct 3, 2024 · 5069a60 · 5069a60
1 parent da9a4f1
commit 5069a60
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/.github/chainguard/fulfilled-bot.sts.yaml b/.github/chainguard/fulfilled-bot.sts.yaml
@@ -0,0 +1,13 @@
+# Copyright 2024 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+issuer: https://accounts.google.com
+# 107106855617134891633: [email protected]
+# TODO(philde): Grant access to the prod service account, when available.
+subject_pattern: "107106855617134891633"
+
+permissions:
+  issues: read
+  organization_projects: read
+
+repositories: [] # Act over all of the repos in the org.