feat(ci): migrate sync-rule-templates to ephemeral GitHub token - #8350
Merged
Conversation
Replace CLOUDSEC_MACHINE_TOKEN with an OIDC-minted ephemeral token via elastic/ci-gh-actions/fetch-github-token. Also fix the hermit action path (./.github/actions/hermit → ./cloudbeat/.github/actions/hermit), which was the root cause of both previous workflow failures. Closes elastic/security-team#19162 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
This pull request does not have a backport label. Could you fix it @gurevichdmitry? 🙏
|
Avoids a hard failure on `git commit` (set -euo pipefail) when the generated templates are identical to what is already in origin/main. Also prevents a spurious integration version bump when there is nothing to ship. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…T ME] Adds the feature branch to the push trigger and makes a trivial data.yaml change so the workflow runs end-to-end from this branch. Revert this commit before merging. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The hermit action assumes cloudbeat is checked out at the workspace root ($GITHUB_WORKSPACE), but this workflow checks out both cloudbeat and integrations as side-by-side subdirectories (required by the generator's hardcoded ../../../integrations path). Hermit's internal steps (find ./bin, ./.ci/scripts/retry.sh, etc.) resolve relative to $GITHUB_WORKSPACE and all fail in this layout. Replace hermit with direct installation of only the tools this workflow actually needs: Poetry (for generate_rule_templates.py) and yq (for bump_integration_version in common.sh). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pipx is pre-installed on ubuntu-22.04 runners; yq 4.53.6 is also pre-installed so no snap install needed. setup-python activates Python 3.11 from the runner tool cache. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Read changelog comment header before yq (which strips comments) - Find version map entry by grep pattern instead of hardcoded line number - Restore comment block after yq via awk+temp file (cross-platform) - Replace macOS-only `sed -i ''` with portable temp-file approach Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ling - Add bump_patch_version helper - Patch-bump within current minor series (e.g. 3.5.1 → 3.5.2-preview01) when version map already has an entry for that minor; minor-bump only when starting a new series - Strip comments yq preserves mid-file before restoring header block - Fix shfmt: remove space before output redirection in compound command Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ling newline - Remove test branch trigger (feat/sync-rule-templates-ephemeral-token) - Revert data.yaml test change (default_value) - Add trailing newline to generated JSON templates to match existing files in elastic/integrations and avoid noisy diffs in sync PRs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
olegsu
approved these changes
Sep 8, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Revives
.github/workflows/sync-rule-templates.ymlso CISdata.yamlchanges onmainopen/update a PR inelastic/integrations. Authenticates with an ephemeral GitHub token (OIDC + TokenPolicy) instead ofCLOUDSEC_MACHINE_TOKEN.Changes
secrets.CLOUDSEC_MACHINE_TOKENwith an OIDC-minted ephemeral token viaelastic/ci-gh-actions/fetch-github-token(same pattern assync-internal-cloudbeat-version.yml)id-token: writepermission at job level; restrict top-level permissions tocontents: readsetup-python+pipx install poetrysteps — hermit's composite action uses paths relative to$GITHUB_WORKSPACEbut cloudbeat is checked out to a subdirectory (cloudbeat/)bump_integration_versioninscripts/common.shfor Linux: read version map comment beforeyqstrips it, patch-bump within the current minor series instead of always minor-bumping, strip yq-preserved comments before restoring the header block, replace macOS-onlysed -i ''with portable approachgenerate_rule_templates.pyto write a trailing newline on generated JSON files, avoiding noisy diffs inelastic/integrationsPRssync_rule_templates.shwhen no template changes are detectedPre-requisites
TokenPolicy
token-policy-cloudbeat-sync-rule-templates— already merged and realized:ci-prodelastic/cloudbeat/.github/workflows/sync-rule-templates.yml@*elastic/integrationscontents: write,pull_requests: write,issues: writeTest results ✅
Workflow ran end-to-end successfully from this branch:
Verified:
elastic/integrationswith correct labels and version bump (3.5.2-preview01,^9.6.0)CLOUDSEC_MACHINE_TOKENreferences remainTracked in: https://github.com/elastic/security-team/issues/19162
🤖 Generated with Claude Code