From cad879c9803590190f568af4aaf89b23b22f9207 Mon Sep 17 00:00:00 2001 From: ascendho Date: Tue, 28 Jul 2026 11:29:47 +0800 Subject: [PATCH] Document immutable OIDC subject --- docs/MARKETPLACE_PUBLISHING.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/MARKETPLACE_PUBLISHING.md b/docs/MARKETPLACE_PUBLISHING.md index 0db4c67..f90a568 100644 --- a/docs/MARKETPLACE_PUBLISHING.md +++ b/docs/MARKETPLACE_PUBLISHING.md @@ -49,10 +49,15 @@ store a Personal Access Token. --identity-name threadrelink-marketplace-publisher \ --resource-group threadrelink-publishing \ --issuer https://token.actions.githubusercontent.com \ - --subject repo:ascendho/ThreadRelink:environment:marketplace \ + --subject 'repo:ascendho@78126591/ThreadRelink@1313819450:environment:marketplace' \ --audiences api://AzureADTokenExchange ``` + This repository uses GitHub's immutable owner and repository IDs in OIDC + subjects. The numeric IDs remain stable if the owner or repository is + renamed. A fork or transferred repository must use the subject shown in its + own GitHub OIDC assertion. + 6. Create a GitHub Environment named `marketplace`. Restrict its deployment tags to `v*`, then add these non-secret environment variables: