[eseidel]

Service accounts and GitHub Actions OIDC sign-in are live (the console's Service Accounts tab first went to prod on 2026-10-18; OIDC sign-in shipped in CLI 1.6.129 on 2026-10-16), and their docs are up (#733, #734), but neither is in the changelog. This adds the two entries, so customers reading the changelog learn they exist.

Changes

• service-accounts.md: dated 2026-10-15, the first prod deploy carrying the service account API (the template's rule); the console tab was linked on 2026-10-18 (shorebirdtech/_shorebird#3605).
• api-key-scopes-every-plan.md: drops its claim that service account keys take the release-and-patch scope; they take no scope.
• github-actions-oidc.md: dated 2026-10-16, version 1.6.129.

The copy was drafted against the code and docs PRs; each claim (roles, key expiries, [bot] names, trust rule plan gate, SHOREBIRD_TOKEN precedence, the service_account.sign_in audit event) matches the published service accounts, trust rules and GitHub Actions pages.

Screenshots

No visible change beyond two new changelog entries rendered from the existing template.

Landing

As soon as approved.

🤖 Generated with Claude Code

[eseidel]

Adversarial review (separate agent, no context from the author)

1. Medium. The two entries read out of order. The OIDC entry (10-16) signs in "as a service account", but service accounts are introduced on 10-18. Under the template's rule (first prod deploy), the service account API shipped on 2026-10-15.
2. Medium. api-key-scopes-every-plan.md still says service account keys take the "Release and patch only" scope. The server now rejects any scope on a service account key.
3. Low. The audit log shows "the key or trust rule it used", not only the key.
4. Low. The OIDC entry advertises the service_account.sign_in audit event without saying the audit log is Enterprise-only, while trust rules are Business+.
5. Nit. The service accounts entry is long for this changelog (6 bullets, most entries have 1–3), and part of it is walkthrough material already on the linked page.
6. Nit. An org has one Owner, so "Admins and Owners" should be "Owner and Admins".

Checked and fine: 1.6.129's date and contents, the trust rule plan gate and how rules behave after a downgrade, key expiries, the Auditor permission, [bot] names, SHOREBIRD_TOKEN precedence, the docLink anchors, and the frontmatter.

[eseidel]

All six are addressed in b4dff52:

1. Fixed: service accounts is now dated 2026-10-15, the first prod deploy with the API, following the template's rule. It precedes the OIDC entry. I dropped "Find them under Settings, Service Accounts", which wasn't true until the tab was linked on 10-18.
2. Fixed: api-key-scopes-every-plan.md now says a service account's keys take no scope and do what its role allows.
3. Fixed: "the key or trust rule it used".
4. Fixed: the bullet now opens "On the Enterprise plan, each sign-in is recorded…".
5. Fixed: the entry is trimmed to five bullets. The rotation tip and the SHOREBIRD_TOKEN/bearer usage are gone, since both are on the linked page.
6. Fixed: "The Owner and Admins manage service accounts".

[AbhishekDoshi26]

2 findings, both nits.

1. src/content/changelog/api-key-scopes-every-plan.md:15: "take no scope; they do what its role allows" is the only semicolon in any published changelog entry (git grep ";" origin/main -- 'src/content/changelog/*.md' finds none outside the template). Suggest "A service account's keys take no scope. They do what its role allows."

2. src/content/changelog/service-accounts.md:15-17: "holds one role, Viewer, Developer, App Manager, or Auditor, and its keys..." puts the role list between commas, so it reads as a five-item series. Suggest "Each service account holds one role: Viewer, Developer, App Manager, or Auditor. Its keys do what that role allows. A service account can't be an Admin or Owner."

Checked and correct: the 2026-10-15 date (the service account API, key expiry rule, roles and scope rejection, Auditor role and trust rules were all in prod by the end of 10-15 PDT), the console tab reaching prod on 10-18, OIDC sign-in being new in 1.6.129 (no OIDC code at v1.6.128; RELEASE_NOTES dates 1.6.129 October 16), SHOREBIRD_TOKEN taking precedence over OIDC in auth.dart, the four roles in serviceAccountRoles with no Admin/Owner, Auditor holding only audit log view, the Business trust-rule gate, 365-day default/max with never allowed, scope rejected on service account keys, the [bot] label and service_account.sign_in event. Both docLinks resolve, entries follow the template, and nothing contradicts #750.

I'll push fixes for both.

[AbhishekDoshi26]

No findings.

Round 2, full diff at 652a3cf. Both round-1 nits are fixed (no semicolon in api-key-scopes-every-plan.md; the role list follows a colon). Re-checked the dates against the Deploy All to Prod runs (service account API, roles, key expiry and trust rules all in prod by end of 2026-10-15 PDT; OIDC in v1.6.129, dated October 16 in RELEASE_NOTES and absent at v1.6.128), the four service account roles, the Auditor permission set, 365-day default/max with never allowed, scope refused on service account keys, the [bot] label, the service_account.sign_in event, the Business trust-rule gate and SHOREBIRD_TOKEN precedence. Consistent with the published pages and with #750; template, docLinks and Prettier all pass.