From 18fa0f197a43aa749fe8f9191076f4a79e21eaa6 Mon Sep 17 00:00:00 2001 From: Nick Janetakis Date: Thu, 17 Sep 2026 08:19:47 -0400 Subject: [PATCH 1/2] Add callout about immutable claim prefixes --- .../authentication/oidc-connections/rulesets-claims.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/manuals/security/authentication/oidc-connections/rulesets-claims.md b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md index 62e0b00d7562..96a431c52fff 100644 --- a/content/manuals/security/authentication/oidc-connections/rulesets-claims.md +++ b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md @@ -83,6 +83,10 @@ You can use wildcards to match across repositories or branches: | `repo:my-org/*` | All repos in the organization | | `repo:my-org/my-repo:ref:refs/heads/release-*` | All branches starting with `release-` | +For GitHub repositories created after July 15, 2026 you can find your +repo's immutable claim prefix under Settings -> Actions -> OIDC. In that +case, for the pattern you'd use `repo:my-org@123456/my-repo@1234567890`. + ## Resources Resources define the Docker resources a workflow can access when a ruleset From 4a004bac1d2524380cf053bdd7082a33e6ffc7c7 Mon Sep 17 00:00:00 2001 From: Nick Janetakis Date: Fri, 18 Sep 2026 16:32:25 -0400 Subject: [PATCH 2/2] Streamline messaging --- .../authentication/oidc-connections/rulesets-claims.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/manuals/security/authentication/oidc-connections/rulesets-claims.md b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md index 96a431c52fff..14e061a6a3f9 100644 --- a/content/manuals/security/authentication/oidc-connections/rulesets-claims.md +++ b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md @@ -73,7 +73,8 @@ The exact format varies and depends on what triggered the workflow. > identifiers for default subject claims. For example: > `repo:octocat@123456/my-repo@456789:ref:refs/heads/main`. See the > [GitHub changelog](https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/) -> for more details. +> for more details. You can find your repository's IDs in GitHub under +> Settings -> Actions -> OIDC to use in the examples below. You can use wildcards to match across repositories or branches: @@ -83,10 +84,6 @@ You can use wildcards to match across repositories or branches: | `repo:my-org/*` | All repos in the organization | | `repo:my-org/my-repo:ref:refs/heads/release-*` | All branches starting with `release-` | -For GitHub repositories created after July 15, 2026 you can find your -repo's immutable claim prefix under Settings -> Actions -> OIDC. In that -case, for the pattern you'd use `repo:my-org@123456/my-repo@1234567890`. - ## Resources Resources define the Docker resources a workflow can access when a ruleset