I am using a CEL expression for setting conditions on the Service Account usage of a Workload Identity Federation provider for GitHub Actions.
Here is the expression
(assertion.repository=='MyOrg/MyRepo' && (assertion.event_name=='pull_request' || assertion.event_name=='workflow_dispatch') && assertion.job_workflow_ref.startsWith('MyOrg/MyRepo/.github/workflows/myworkflow.yaml') && assertion.ref.startsWith('refs/heads/rule/'))
I am creating a Pull Request from a branch named rule/lala2. However the authentication fails "due to attribute condition"
If I remove the last statement, i.e. assertion.ref.startsWith('refs/heads/rule/') it works.
What am I missing here?