Version: v5.6.1

opschain admin github-trust-policies

integrations:github

Manage the trust policies the GitHub Actions OIDC token exchange decides against. A policy belongs to a GitHub connection and maps claim predicates onto a service identity: a workflow run whose verified OIDC token matches the policy's repository, ref and environment patterns exchanges it for a short-lived OpsChain access token acting as the policy's service account, valid for the policy's TTL. Patterns match with * (any run of characters, / included, so refs/heads/* covers nested branch names) and ? (one character); repository matching is case-insensitive.

What the exchanged token may read is the service identity's own authorisation grants — never the person who triggered the workflow. Scope the service account's grants to exactly the paths the pipeline needs; the policy decides who exchanges, the grants decide what the exchanged token sees.

Policies are matched in name order, first match wins — a deterministic order, so name specific policies to sort before broad ones. Creating a policy requires the integrations:github entitlement and sits behind the trust-policy limit (3 on the Basic tier, named in the refusal with the uplift remedy).

Subcommand	Purpose
`list`	Every policy: predicates, service identity, enabled state.
`show <name-or-id>`	One policy's record.
`create <name>`	Declare a policy on a connection.
`update <name-or-id>`	Change predicates, service identity, TTL or enabled state.
`delete <name-or-id>`	Remove a policy.

Every verb rides the v2 GitHubIntegrationService, which authenticates user tokens only: the caller's own opschain login session is the primary credential. An explicit --auth-token wins, and OPSCHAIN_ADMIN_TOKEN / the opschain admin login token remain the fallback for automation; the server still requires the /admin updatable determination.

Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.

See also​

See also