GitHub trust policy

integrations:github

A GitHub trust policy is one admin-defined mapping from GitHub Actions OIDC claim predicates (repository, ref, environment) to an OpsChain service account: when a workflow presents its OIDC token to the exchange, policies on the presenting connection are matched name-ascending and the first enabled match mints a short-lived API token acting as the policy's service account. What the minted token may do is that identity's own grants, never the initiating human's. Served by the v2 GitHubIntegrationService (ListGitHubTrustPolicies, GetGitHubTrustPolicy, CreateGitHubTrustPolicy, UpdateGitHubTrustPolicy, DeleteGitHubTrustPolicy, ExchangeGitHubActionsToken).

GitHubTrustPolicy

GitHubTrustPolicy is one admin-defined claim-predicate → service identity mapping the exchange decides against. Patterns match with * (any run, / included) and ? (one character); repository matching is case-insensitive, GitHub's own semantics.

Field	Type	Meaning
connection_code	string	The trusted connection's code (the readable pair of connection_id).
connection_id	string	The connection the policy trusts tokens from.
created_at	timestamp	When the record was created.
enabled	boolean	Whether the record is enabled.
environment_pattern	string	The GitHub environment claim predicate. Default ""; a job outside any environment presents an empty claim, which only "" or "" match.
id	string	The record's identity.
name	string	The policy's unique name — the exchange's deterministic match order is name ascending, first match wins.
ref_pattern	string	The ref claim predicate, e.g. "refs/heads/main" or "refs/tags/". Default "".
repository_pattern	string	The repository claim predicate, e.g. "my-org/*" or "my-org/payments".
service_account	string	The service account's username (the readable pair of service_account_id).
service_account_id	string	The service account the minted token acts as — what the token may read is this identity's own authz grants, never the initiating human's.
token_ttl_seconds	integer	The minted token's TTL, 60–3600 seconds (default 900).
updated_at	timestamp	When the record was last updated.

Related pages

• opschain docs integrations-github — the component page, exchange flow included.
• opschain docs resources/github_connection — the connection the policy trusts tokens from.
• opschain docs resources/service_account — the identity the minted token acts as.