add sts policy for github automation

Author: cpanato

.github/chainguard/sync-github.sts.yaml

@@ -0,0 +1,13 @@
+# Copyright 2025 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+issuer: https://token.actions.githubusercontent.com
+subject: repo:chainguard-dev/infra:ref:refs/heads/main
+claim_pattern:
+  job_workflow_ref: chainguard-dev/infra/.github/workflows/.terraform.yaml@.*
+
+permissions:
+  members: write # to add/remove GitHub members
+  metadata: read # to read metadata about the org
+
+repositories: [] # Act over all of the repos in the org.

.github/chainguard/verify-github.sts.yaml

@@ -0,0 +1,13 @@
+# Copyright 2025 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: repo:chainguard-dev/infra:.*
+claim_pattern:
+  job_workflow_ref: chainguard-dev/infra/.github/workflows/.terraform.yaml@.*
+
+permissions:
+  members: write # to add/remove GitHub members
+  metadata: read # to read metadata about the org
+
+repositories: [] # Act over all of the repos in the org.