From e497c5f3474d69abb317dac1de704669658ab8ae Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 28 Sep 2026 16:17:41 +0000
Subject: [PATCH] fix(iam): match the default pull request OIDC subject
 (PLAT-234)

Trust refs/pull/* so seahaven-org-baseline pull request tokens can assume
the policy-check role. The immutable subject claim is not enabled.

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---
 oidc-deploy-roles.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index b096864..c210ed0 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1405,7 +1405,9 @@ Resources:
               StringLike:
                 token.actions.githubusercontent.com:sub:
                   - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:pull_request
+                  # use_immutable_subject is false, so pull_request tokens use
+                  # repo:ORG/seahaven-org-baseline:ref:refs/pull/N/merge.
+                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/pull/*
       Policies:
         - PolicyName: access-analyzer-policy-check
           PolicyDocument: