From 0af71e7ea88e811d33b5164bb69d08d785feba34 Mon Sep 17 00:00:00 2001 From: Eric Seidel Date: Tue, 20 Oct 2026 08:30:58 -0600 Subject: [PATCH 1/3] docs: changelog for service accounts and GitHub Actions OIDC sign-in Co-Authored-By: Claude Opus 5.5 --- src/content/changelog/github-actions-oidc.md | 26 ++++++++++++++++++ src/content/changelog/service-accounts.md | 28 ++++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 src/content/changelog/github-actions-oidc.md create mode 100644 src/content/changelog/service-accounts.md diff --git a/src/content/changelog/github-actions-oidc.md b/src/content/changelog/github-actions-oidc.md new file mode 100644 index 00000000..cdecdf50 --- /dev/null +++ b/src/content/changelog/github-actions-oidc.md @@ -0,0 +1,26 @@ +--- +title: Sign in from GitHub Actions without a stored key +date: 2026-10-16 +version: 1.6.129 +area: CLI +type: New +docLink: + label: Sign in with OIDC instead of a stored key + href: /code-push/ci/github/#sign-in-with-oidc-instead-of-a-stored-key +--- + +On GitHub Actions, the CLI can now sign in as a service account with the OIDC +token GitHub issues to each job, so there's no `SHOREBIRD_TOKEN` secret to leak +or rotate. + +- Add a trust rule to a service account naming the repository, the workflow + file, and optionally a GitHub environment and a ref pattern. Only jobs that + match sign in. +- In the workflow, grant the job `id-token: write` and set + `SHOREBIRD_PROJECT_ID`. +- Adding a trust rule needs a Business or Enterprise plan. Existing rules keep + working after a downgrade. +- When `SHOREBIRD_TOKEN` is set, the CLI uses it instead, so remove the secret + once the workflow signs in with a trust rule. +- Each sign-in is recorded in the audit log as `service_account.sign_in`, with + the run it came from. diff --git a/src/content/changelog/service-accounts.md b/src/content/changelog/service-accounts.md new file mode 100644 index 00000000..d3aad128 --- /dev/null +++ b/src/content/changelog/service-accounts.md @@ -0,0 +1,28 @@ +--- +title: Service accounts for CI and integrations +date: 2026-10-18 +area: Console +type: New +docLink: + label: Service accounts + href: /account/service-accounts/ +--- + +Organizations can now create service accounts: accounts that belong to the +organization instead of a person, with keys that keep working when the person +who set them up leaves or changes roles. Find them under Settings, Service +Accounts. They're available on every plan. + +- Each service account holds one role, Viewer, Developer, App Manager, or + Auditor, and its keys do what that role allows. A service account can't be an + Admin or Owner. +- Keys expire after 1 year by default. Choose 30 days, 90 days, 1 year, or + never, and issue a second key to rotate without downtime. +- The audit log shows a service account's actions as its name followed by + `[bot]`, such as `GitHub Actions[bot]`, along with the key it used. +- The new Auditor role reads the audit log and nothing else, for exporting it to + a SIEM without an Admin's key. The audit log needs the Enterprise plan. +- Use a key like any API key: set it as `SHOREBIRD_TOKEN` for the CLI, or send + it as a bearer token to the API. +- Admins and Owners manage service accounts. They don't appear on the Members + page. From b4dff52b7f99c5ffe9e0864850af6568d89f7232 Mon Sep 17 00:00:00 2001 From: Eric Seidel Date: Tue, 20 Oct 2026 08:39:48 -0600 Subject: [PATCH 2/3] docs: address adversarial review of service accounts changelog Co-Authored-By: Claude Opus 5.5 --- .../changelog/api-key-scopes-every-plan.md | 2 +- src/content/changelog/github-actions-oidc.md | 4 ++-- src/content/changelog/service-accounts.md | 17 +++++++---------- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/src/content/changelog/api-key-scopes-every-plan.md b/src/content/changelog/api-key-scopes-every-plan.md index c325e69b..5d0327c4 100644 --- a/src/content/changelog/api-key-scopes-every-plan.md +++ b/src/content/changelog/api-key-scopes-every-plan.md @@ -12,4 +12,4 @@ API keys limited to releases and patches are now available on every plan, including Free. They used to need a paid plan. - The console no longer disables the "Release and patch only" option on the Free - plan, for personal API keys or for service account keys. + plan. A service account's keys take no scope; they do what its role allows. diff --git a/src/content/changelog/github-actions-oidc.md b/src/content/changelog/github-actions-oidc.md index cdecdf50..d8a3c93b 100644 --- a/src/content/changelog/github-actions-oidc.md +++ b/src/content/changelog/github-actions-oidc.md @@ -22,5 +22,5 @@ or rotate. working after a downgrade. - When `SHOREBIRD_TOKEN` is set, the CLI uses it instead, so remove the secret once the workflow signs in with a trust rule. -- Each sign-in is recorded in the audit log as `service_account.sign_in`, with - the run it came from. +- On the Enterprise plan, each sign-in is recorded in the audit log as + `service_account.sign_in`, with the run it came from. diff --git a/src/content/changelog/service-accounts.md b/src/content/changelog/service-accounts.md index d3aad128..5d75fb73 100644 --- a/src/content/changelog/service-accounts.md +++ b/src/content/changelog/service-accounts.md @@ -1,6 +1,6 @@ --- title: Service accounts for CI and integrations -date: 2026-10-18 +date: 2026-10-15 area: Console type: New docLink: @@ -10,19 +10,16 @@ docLink: Organizations can now create service accounts: accounts that belong to the organization instead of a person, with keys that keep working when the person -who set them up leaves or changes roles. Find them under Settings, Service -Accounts. They're available on every plan. +who set them up leaves or changes roles. They're available on every plan. - Each service account holds one role, Viewer, Developer, App Manager, or Auditor, and its keys do what that role allows. A service account can't be an Admin or Owner. -- Keys expire after 1 year by default. Choose 30 days, 90 days, 1 year, or - never, and issue a second key to rotate without downtime. +- Keys expire after 1 year by default, or choose 30 days, 90 days, or never. - The audit log shows a service account's actions as its name followed by - `[bot]`, such as `GitHub Actions[bot]`, along with the key it used. + `[bot]`, such as `GitHub Actions[bot]`, along with the key or trust rule it + used. - The new Auditor role reads the audit log and nothing else, for exporting it to a SIEM without an Admin's key. The audit log needs the Enterprise plan. -- Use a key like any API key: set it as `SHOREBIRD_TOKEN` for the CLI, or send - it as a bearer token to the API. -- Admins and Owners manage service accounts. They don't appear on the Members - page. +- The Owner and Admins manage service accounts, which don't appear on the + Members page. From 652a3cff0b3a63b9f229f225d8d53ad401f302e1 Mon Sep 17 00:00:00 2001 From: Abhishek Doshi Date: Wed, 21 Oct 2026 16:30:56 +0530 Subject: [PATCH 3/3] docs: drop the semicolon and set off the role list in changelog entries --- src/content/changelog/api-key-scopes-every-plan.md | 2 +- src/content/changelog/service-accounts.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/changelog/api-key-scopes-every-plan.md b/src/content/changelog/api-key-scopes-every-plan.md index 5d0327c4..e9b2f52a 100644 --- a/src/content/changelog/api-key-scopes-every-plan.md +++ b/src/content/changelog/api-key-scopes-every-plan.md @@ -12,4 +12,4 @@ API keys limited to releases and patches are now available on every plan, including Free. They used to need a paid plan. - The console no longer disables the "Release and patch only" option on the Free - plan. A service account's keys take no scope; they do what its role allows. + plan. A service account's keys take no scope. They do what its role allows. diff --git a/src/content/changelog/service-accounts.md b/src/content/changelog/service-accounts.md index 5d75fb73..74a6c577 100644 --- a/src/content/changelog/service-accounts.md +++ b/src/content/changelog/service-accounts.md @@ -12,8 +12,8 @@ Organizations can now create service accounts: accounts that belong to the organization instead of a person, with keys that keep working when the person who set them up leaves or changes roles. They're available on every plan. -- Each service account holds one role, Viewer, Developer, App Manager, or - Auditor, and its keys do what that role allows. A service account can't be an +- Each service account holds one role: Viewer, Developer, App Manager, or + Auditor. Its keys do what that role allows. A service account can't be an Admin or Owner. - Keys expire after 1 year by default, or choose 30 days, 90 days, or never. - The audit log shows a service account's actions as its name followed by