From 4d35c8bff45cdc2f3234aa6cebbf3b7c12e85d81 Mon Sep 17 00:00:00 2001 From: Anushka Mittal Date: Tue, 8 Sep 2026 09:19:32 +0530 Subject: [PATCH] feat(alert-slack-bot): grant contents:read for prod-alerts source lookup The prod-alerts digest reads mono source to explain what an alert or DLQ is about, via the shared githubsource reader over the org-scoped alert-slack-bot token (chainguard-dev/mono#51527). Add contents:read to the existing policy; it stays limited to mono and read-only. Mirrors #305 for guardbot. --- .github/chainguard/alert-slack-bot.sts.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/chainguard/alert-slack-bot.sts.yaml b/.github/chainguard/alert-slack-bot.sts.yaml index 8570b29..1bdaa92 100644 --- a/.github/chainguard/alert-slack-bot.sts.yaml +++ b/.github/chainguard/alert-slack-bot.sts.yaml @@ -1,14 +1,16 @@ # Copyright 2026 Chainguard, Inc. # SPDX-License-Identifier: Apache-2.0 -# Read-only access for the alert-slack-bot review-queue policy: team -# membership lookup plus PR search, limited to mono. +# Read-only access for the alert-slack-bot policies: team membership lookup +# and PR search for the review queue, plus contents read so the prod-alerts +# digest can look up what an alert or DLQ is about in source. Limited to mono. issuer: https://accounts.google.com # alert-slack-bot@staging-enforce-cd1e | alert-slack-bot@prod-enforce-fabc subject_pattern: (114816490335454510913|115816735061299852605) permissions: + contents: read members: read pull_requests: read metadata: read