From 21e5934fa16992a7b8d48b6c0461cfa272d8760a Mon Sep 17 00:00:00 2001 From: Ed Savage Date: Fri, 24 Jul 2026 14:35:35 +1200 Subject: [PATCH] [ML] Pass explicit vault-role for the Backstage-registered backport token policy Co-authored-by: Cursor --- .github/workflows/backport.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index cb183b1fc..8c1cb26fa 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -66,6 +66,12 @@ jobs: uses: elastic/ci-gh-actions/fetch-github-token@v1 with: vault-instance: "ci-prod" + # The Token Policy was registered via the Backstage self-service template, + # which names the Vault role after the AppRole name (token-policy-ml-cpp-backport) + # rather than the SHA-256 hash of the workflow ref that fetch-github-token + # derives by default. Pass the role explicitly so the lookup matches the + # registered policy (github/token/token-policy-ml-cpp-backport). + vault-role: "token-policy-ml-cpp-backport" - name: Backport Action id: backport