ci: remove obsolete ref_protected from STS trust policies (#7676)

d-niu · web-flow · commit f20430cc2ba0 · 2026-03-18T04:35:17.000Z
The `ref_protected` OIDC claim is now universally `true` in the DataDog org due to the org-level "incompatible file paths on windows" push ruleset, making it useless as a security discriminator. Ticket: https://datadoghq.atlassian.net/browse/SINT-4732
diff --git a/.github/chainguard/release-proposal.sts.yaml b/.github/chainguard/release-proposal.sts.yaml
@@ -5,7 +5,6 @@ subject: repo:DataDog/dd-trace-js:ref:refs/heads/master
 claim_pattern:
   event_name: (workflow_dispatch|schedule)
   ref: refs/heads/master
-  ref_protected: "true"
   job_workflow_ref: DataDog/dd-trace-js/.github/workflows/release-proposal.yml@refs/heads/master
 
 permissions:
