opschain admin github-trust-policies create

integrations:github

Declares a trust policy: which workflow runs (by repository, ref and environment claim patterns) may exchange their Actions OIDC token, and the service account the minted token acts as. The service account must already exist (opschain admin service-accounts create) — a human identity refuses, because the exchanged token acts as the policy's identity, never as whoever clicked. The name is immutable and unique; policies match in name order, first match wins.

opschain admin github-trust-policies create payments-main \
  --connection corp-github --repository 'my-org/payments' \
  --ref 'refs/heads/main' --service-account gha-payments
Created trust policy payments-main (repository my-org/payments -> service account gha-payments)

Creating a policy requires the integrations:github entitlement and counts against the trust-policy limit (3 on the Basic tier; the refusal names the limit and the uplift remedy).

--scope-prefix clamps every session the policy mints to one node-path subtree: the service account's own grants decide inside it, and every authorisation decision outside it denies — a pipeline for one project cannot read, raise or approve anything in another, whatever the service account could otherwise see. The clamp rides the minted token itself and is named on the exchange answer (scope_prefix).

opschain admin github-trust-policies create payments-main \
  --connection corp-github --repository 'my-org/payments' \
  --ref 'refs/heads/main' --service-account gha-payments \
  --scope-prefix /projects/payments

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--connection <code-or-id>	The GitHub connection to trust tokens from.
--repository <pattern>	Repository claim predicate, e.g. my-org/* or my-org/payments.
--ref <pattern>	Git ref claim predicate, e.g. refs/heads/main or refs/tags/* (default *).
--environment <pattern>	GitHub environment claim predicate (default *; a job outside any environment presents an empty claim, which only * matches).
--service-account <username>	The service account the minted token acts as.
--token-ttl <seconds>	Minted token TTL, 60–3600 (0: 900, the short-lived default).
--enabled	Whether the exchange matches against the policy (default true).
--scope-prefix <path>	Node path the exchanged session is clamped to, e.g. /projects/payments; every authorisation decision outside it denies. Empty: the service account's whole overlay.

See also

• opschain docs cli/admin-github-connections-create — the connection a policy hangs off.