opschain admin github-trust-policies create
integrations:github
Declares a trust policy: which workflow runs (by repository, ref and
environment claim patterns) may exchange their Actions OIDC token, and
the service account the minted token acts as. The service account must
already exist (opschain admin service-accounts create) — a human
identity refuses, because the exchanged token acts as the policy's
identity, never as whoever clicked. The name is immutable and unique;
policies match in name order, first match wins.
opschain admin github-trust-policies create payments-main \
--connection corp-github --repository 'my-org/payments' \
--ref 'refs/heads/main' --service-account gha-payments
Created trust policy payments-main (repository my-org/payments -> service account gha-payments)
Creating a policy requires the integrations:github entitlement and
counts against the trust-policy limit (3 on the Basic tier; the
refusal names the limit and the uplift remedy).
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--connection <code-or-id> | The GitHub connection to trust tokens from. |
--repository <pattern> | Repository claim predicate, e.g. my-org/* or my-org/payments. |
--ref <pattern> | Git ref claim predicate, e.g. refs/heads/main or refs/tags/* (default *). |
--environment <pattern> | GitHub environment claim predicate (default *; a job outside any environment presents an empty claim, which only * matches). |
--service-account <username> | The service account the minted token acts as. |
--token-ttl <seconds> | Minted token TTL, 60–3600 (0: 900, the short-lived default). |
--enabled | Whether the exchange matches against the policy (default true). |
See also
opschain docs cli/admin-github-connections-create— the connection a policy hangs off.