Skip to content

Grant id-token write for cosign OIDC signing - #4140

Open
dfarrell07 wants to merge 1 commit into
submariner-io:release-0.22from
dfarrell07:glasswing-pr8-release-0.22
Open

Grant id-token write for cosign OIDC signing#4140
dfarrell07 wants to merge 1 commit into
submariner-io:release-0.22from
dfarrell07:glasswing-pr8-release-0.22

Conversation

@dfarrell07

@dfarrell07 dfarrell07 commented Aug 19, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Grants id-token: write on the release workflow so shipyard's cosign keyless signing (FIND-015) can mint a GitHub OIDC token from inside the Dapper container.

Effective only after shipyard's FIND-015 change merges and the shipyard-dapper-base image is rebuilt/republished.

See commit messages for details.

Summary by CodeRabbit

  • Chores
    • Updated release automation permissions to support secure identity-based authentication.
    • Preserved read-only access to repository contents during release workflows.

@dfarrell07
Grant id-token write for cosign OIDC signing
678deb7 
Shipyard's release script now signs pushed images with cosign
keyless (Sigstore OIDC), which requires id-token: write on the
release workflow. Replace the empty permissions block with the
minimal set: id-token: write for OIDC and contents: read for
checkout.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
@dfarrell07 dfarrell07 self-assigned this Aug 19, 2026
@submariner-bot

submariner-bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

🤖 Created branch: z_pr4140/dfarrell07/glasswing-pr8-release-0.22
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

@coderabbitai

coderabbitai Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 59d1153b-c0f6-4b3d-a788-f2d91894a937

📥 Commits

Reviewing files that changed from the base of the PR and between 259a373 and 678deb7.

📒 Files selected for processing (1)
  • .github/workflows/release.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

Walkthrough

The release workflow now grants id-token: write and contents: read permissions instead of an empty permissions configuration.

Changes

Release workflow

Layer / File(s) Summary
Configure release workflow permissions
.github/workflows/release.yml		 The workflow grants write access to the OIDC identity token and read access to repository contents.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 678de

This localized workflow change grants the release job permission to mint GitHub OIDC tokens for signing; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

Suggested reviewers: skitt, vthapar, sridhargaddam, tpantelis, yboaron

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Actionable Comments Resolved ❌ Error The bot comment requires the ready-to-test label for full E2E testing, but the PR has no labels and no approvals; this actionable item remains unresolved. Apply ready-to-test manually or obtain two approvals so the bot adds it, then run the required full E2E testing.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: granting GitHub Actions OIDC token write permission for cosign signing.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot mentioned this pull request Aug 19, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mkolesnik mkolesnik Awaiting requested review from mkolesnik mkolesnik is a code owner
@Oats87 Oats87 Awaiting requested review from Oats87 Oats87 is a code owner
@skitt skitt Awaiting requested review from skitt skitt is a code owner
@sridhargaddam sridhargaddam Awaiting requested review from sridhargaddam sridhargaddam is a code owner
@tpantelis tpantelis Awaiting requested review from tpantelis tpantelis is a code owner
@vthapar vthapar Awaiting requested review from vthapar vthapar is a code owner
@yboaron yboaron Awaiting requested review from yboaron yboaron is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@dfarrell07 dfarrell07

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dfarrell07 @submariner-bot