From 959ce944ef88430ecd2e3a57a50d72742acde2ca Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 14 Jul 2026 13:54:24 -0400
Subject: [PATCH] Remove rename-transition sub from account-baseline deploy
 role

Post-rename deploy verified green from seahaven-org-baseline (run
29355616637, both account jobs). The freed repo name must not stay
trusted (namespace-reuse window, security review IAC-02).
---
 oidc-deploy-roles.yaml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index 5e44d24..17d5818 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1247,12 +1247,7 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                # Transition pair for the seahaven-account-baseline ->
-                # seahaven-org-baseline repo rename (2026-07-14). The old sub is
-                # removed once a post-rename deploy is verified green.
-                token.actions.githubusercontent.com:sub:
-                  - !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
       Policies:
         - PolicyName: cdk-deploy
           PolicyDocument: