From e7e141dad81e6dbe126b6b160b856b3a3e08d3cf Mon Sep 17 00:00:00 2001 From: d <88739846+d-niu@users.noreply.github.com> Date: Wed, 4 Mar 2026 17:34:43 -0500 Subject: [PATCH] Remove obsolete `ref_protected` from STS trust policies The `ref_protected` OIDC claim is now universally `true` in the DataDog org due to the org-level "incompatible file paths on windows" push ruleset, making it useless as a security discriminator. Ticket: https://datadoghq.atlassian.net/browse/SINT-4732 Co-Authored-By: Claude Opus 4.6 --- .github/chainguard/self.issue-labeler.sts.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/chainguard/self.issue-labeler.sts.yaml b/.github/chainguard/self.issue-labeler.sts.yaml index 3ccb92d951..88b0ea24a6 100644 --- a/.github/chainguard/self.issue-labeler.sts.yaml +++ b/.github/chainguard/self.issue-labeler.sts.yaml @@ -5,7 +5,6 @@ subject: repo:DataDog/datadog-ci:ref:refs/heads/master claim_pattern: event_name: issues ref: refs/heads/master - ref_protected: "true" job_workflow_ref: DataDog/datadog-ci/\.github/workflows/issue-labeler\.yml@refs/heads/master # https://docs.github.com/en/rest/issues/labels?apiVersion=2022-11-28#add-labels-to-an-issue