From 5f93631ae850370ea508f5a86a5e922a5c9e8928 Mon Sep 17 00:00:00 2001 From: Matthew DeGuzman Date: Thu, 16 Apr 2026 14:42:59 -0700 Subject: [PATCH 1/2] ci(chainguard): Add dd-octo-sts policy for rshell version bump --- .../self.rshell.bump-rshell-version.sts.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/chainguard/self.rshell.bump-rshell-version.sts.yaml diff --git a/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml b/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml new file mode 100644 index 000000000000..9dce38c50cef --- /dev/null +++ b/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml @@ -0,0 +1,15 @@ +--- +# Policy used by the `bump_datadog_agent` job in the DataDog/rshell GitLab CI. +# Fires automatically on new rshell semver tags and can also be run manually +# from main (e.g. to retry or bump to a specific version). +issuer: https://gitlab.ddbuild.io + +subject_pattern: 'project_path:DataDog/rshell:(ref_type:tag:ref:v[0-9]+\.[0-9]+\.[0-9]+|ref_type:branch:ref:main)' + +claim_pattern: + project_path: DataDog/rshell + ref_protected: "true" + +permissions: + contents: write + pull_requests: write From 9591821d0776eba76c3458288610bf9449f516f3 Mon Sep 17 00:00:00 2001 From: Matthew DeGuzman Date: Thu, 16 Apr 2026 15:15:27 -0700 Subject: [PATCH 2/2] ci(chainguard): drop ref_protected constraint on rshell policy --- .github/chainguard/self.rshell.bump-rshell-version.sts.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml b/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml index 9dce38c50cef..0826db1fd35f 100644 --- a/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml +++ b/.github/chainguard/self.rshell.bump-rshell-version.sts.yaml @@ -8,7 +8,6 @@ subject_pattern: 'project_path:DataDog/rshell:(ref_type:tag:ref:v[0-9]+\.[0-9]+\ claim_pattern: project_path: DataDog/rshell - ref_protected: "true" permissions: contents: write