Help

PR previews

Aletsaf Administration

Explicitly allow an external OIDC workload to manage PR preview clients below a parent client.

Preview policy

The capability is off by default. Trust only the issuer and claims required for this client.

Parent client Allow PR previews

CI supplies the concrete redirect URL. Aletsaf accepts it only when its origin matches this policy and its path exactly matches the configured callback path.

OIDC workload issuerExact HTTPS issuer. Aletsaf uses its OIDC discovery document and signing keys. Required claimsOne claim=value condition per line. Every workload token must match all conditions. PR binding claimClaim used to bind creation to the requested PR, for example ref. PR binding templateUse exactly one {pr} placeholder, for example refs/pull/{pr}/merge. Allowed preview originUse an exact HTTPS origin or one * wildcard in the left-most hostname label, for example https://*.preview.example.com or https://*-worker.account.workers.dev. OIDC callback path

Managed PR clients

CI creates and disables these clients. Their inherited configuration is read-only here.