Use the immutable sub claim for the run-ruby-wasm role - #75
Merged
Conversation
rurema/run-ruby-wasm was created on 2026-08-16, after GitHub's
2026-07-15 cutoff, so its OIDC tokens carry the immutable subject
claim ("repo:OWNER@OWNER-ID/REPO@REPO-ID:ref:...") and the classic
"repo:rurema/run-ruby-wasm:ref:..." trust condition never matches:
the sync workflow fails with "Not authorized to perform
sts:AssumeRoleWithWebIdentity".
Switch the two sub entries to the immutable form (ids from the
repository's OIDC configuration page, cross-checked against the API).
The other three repositories predate the cutoff and keep the classic
form.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the trust policy of the
docs-sync-run-ruby-wasmrole: the sync workflow in rurema/run-ruby-wasm fails to assume it withNot authorized to perform sts:AssumeRoleWithWebIdentity(failed run).rurema/run-ruby-wasm was created on 2026-08-16, after GitHub's 2026-07-15 cutoff, so its OIDC tokens carry the immutable subject claim —
repo:OWNER@OWNER-ID/REPO@REPO-ID:ref:...— and this cannot be turned off in the repository settings. The classicrepo:rurema/run-ruby-wasm:ref:...condition therefore never matches.This switches the two
subentries (main branch and release tags) to the immutable form. The ids (rurema = 4122513, run-ruby-wasm = 1335558093) are taken from the repository's OIDC configuration page and cross-checked against the API. The other three repositories predate the cutoff and keep the classic form; a comment now warns about the cutoff for future additions.Please apply when convenient — applying together with #74 would make it a single round. After the apply we will re-run the sync with the existing release tag to verify.
(日本語) run-ruby-wasm は 2026-07-15 カットオフ後の作成のため immutable subject claims が強制され、従来形式の trust に一致せず AssumeRole が拒否されていました。sub 2 エントリを immutable 形式へ差し替えます。#74 とまとめて apply いただけると 1 回で済みます。
🤖 Generated with Claude Code