From fc86079df90225a08368a4c0d85a7735ba5dec80 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 14 Jul 2026 13:27:42 -0400
Subject: [PATCH] Trust seahaven-org-baseline sub on account-baseline deploy
 role

Transition pair for the repo rename: OIDC sub claims carry the repo full
name, so the renamed repo cannot assume the role until its sub is
trusted. Old sub is removed after a post-rename deploy verifies green.
---
 oidc-deploy-roles.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index 7ab639f..5e44d24 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1247,7 +1247,12 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
+                # Transition pair for the seahaven-account-baseline ->
+                # seahaven-org-baseline repo rename (2026-07-14). The old sub is
+                # removed once a post-rename deploy is verified green.
+                token.actions.githubusercontent.com:sub:
+                  - !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
+                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
       Policies:
         - PolicyName: cdk-deploy
           PolicyDocument: