Document admission for all repos of an owner (#279)

I really struggleded several days with this and thankfully i found #77 (comment) big thanks to @sethvargo ❤ as @dobromyslov already said, this should be documented so I went ahead and created added a paragrah for this use case --------- Signed-off-by: Daniel Brown <[email protected]>
google-github-actions · Mar 24, 2023 · 5431d4a · 5431d4a
1 parent b0a7180
commit 5431d4a
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -607,6 +607,14 @@ Terraform module to automate your infrastructure provisioning. See [examples](ht
       --role="roles/iam.workloadIdentityUser" \
       --member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}"
     ```
+
+    If you want to admit all repos of an owner (user or organization), map on `attribute.repository_owner`:
+
+    ```sh
+    --member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository_owner/${OWNER}"
+    ```
+
+    For this to work, you need to make sure that `attribute.repository_owner` is mapped in your attribute mapping (see previous step).
 
     Note that `$WORKLOAD_IDENTITY_POOL_ID` should be the **full** Workload
     Identity Pool resource ID, like: