adam/.github
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-09-30 07:03:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove rename-transition sub from account-baseline deploy role

Browse source 
Post-rename deploy verified green from seahaven-org-baseline (run
29355616637, both account jobs). The freed repo name must not stay
trusted (namespace-reuse window, security review IAC-02).
This commit is contained in:
Adam Moussa 2026-07-14 13:54:24 -04:00
parent 3cde673b9d
commit 959ce944ef
No known key found for this signature in database
1 changed files with 1 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
oidc-deploy-roles.yaml
View file

@ -1247,12 +1247,7 @@ Resources:
StringEquals: StringEquals:
token.actions.githubusercontent.com:aud: sts.amazonaws.com token.actions.githubusercontent.com:aud: sts.amazonaws.com
StringLike: StringLike:
# Transition pair for the seahaven-account-baseline -> token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
# seahaven-org-baseline repo rename (2026-07-14). The old sub is
# removed once a post-rename deploy is verified green.
token.actions.githubusercontent.com:sub:
- !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
- !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
Policies: Policies:
- PolicyName: cdk-deploy - PolicyName: cdk-deploy
PolicyDocument: PolicyDocument: