From 09948de4b3c6bc3cf83445ba93ef7bfc5f3a4cf5 Mon Sep 17 00:00:00 2001 From: Adron Hall Date: Tue, 20 Oct 2026 13:42:57 -0700 Subject: [PATCH 1/2] Trust GitHub's immutable OIDC subject for the CI roles The first production deploy failed with 'Not authorized to perform sts:AssumeRoleWithWebIdentity': this repository issues immutable subject claims (repo:CompositeCode@38675098/substratalapps.com@1403762290:...), and the plan and deploy roles trusted the name-only form. The subject is now a variable defaulting to the immutable form, which also means a renamed or recreated repository can't inherit the roles. Already applied. Also ignore .claude/settings.local.json. Co-Authored-By: Claude Opus 5.5 --- .gitignore | 1 + infra/terraform/bootstrap/main.tf | 2 +- infra/terraform/bootstrap/variables.tf | 13 ++++++++++--- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4c78664..e718b15 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ dist/ infra/terraform/**/.terraform/ infra/terraform/**/*.tfstate* infra/terraform/**/.terraform.lock.hcl.bak +.claude/settings.local.json diff --git a/infra/terraform/bootstrap/main.tf b/infra/terraform/bootstrap/main.tf index 9f0a9ac..aaff311 100644 --- a/infra/terraform/bootstrap/main.tf +++ b/infra/terraform/bootstrap/main.tf @@ -227,7 +227,7 @@ resource "aws_iam_openid_connect_provider" "github" { } locals { - oidc_sub = "repo:${var.github_repository}" + oidc_sub = var.github_oidc_subject } # Read-only: terraform plan on pull requests into main. diff --git a/infra/terraform/bootstrap/variables.tf b/infra/terraform/bootstrap/variables.tf index 919637c..875a842 100644 --- a/infra/terraform/bootstrap/variables.tf +++ b/infra/terraform/bootstrap/variables.tf @@ -3,10 +3,17 @@ variable "region" { default = "us-east-1" } -variable "github_repository" { - description = "owner/name of the repository allowed to assume the CI roles" +variable "github_oidc_subject" { + description = <<-EOT + The repository part of the GitHub OIDC `sub` claim the CI roles trust. + This repository uses GitHub's immutable subject claims, which embed the + owner and repository ids (owner@id/name@id), so a renamed or recreated + repository can't inherit the roles. Read the current value with + `gh api repos///actions/oidc/customization/sub` + (sub_claim_prefix). + EOT type = string - default = "CompositeCode/substratalapps.com" + default = "repo:CompositeCode@38675098/substratalapps.com@1403762290" } variable "billing_email" { From 74df3381e5acc8846290424ad8cf928b1c08c85e Mon Sep 17 00:00:00 2001 From: Adron Hall Date: Tue, 20 Oct 2026 13:46:11 -0700 Subject: [PATCH 2/2] Pin Aurora PostgreSQL to 16.15 The first production apply failed: 'Cannot find version 16.6 for aurora-postgresql'. 16.6 has been retired; 16.15 is the newest 16.x, keeping the major version CI and local development test against (postgres:16), and supports the Data API on Serverless v2. Co-Authored-By: Claude Opus 5.5 --- infra/terraform/prod/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/terraform/prod/main.tf b/infra/terraform/prod/main.tf index 9264280..a6f38af 100644 --- a/infra/terraform/prod/main.tf +++ b/infra/terraform/prod/main.tf @@ -46,7 +46,7 @@ resource "aws_rds_cluster" "main" { cluster_identifier = "${local.prefix}-db" engine = "aurora-postgresql" engine_mode = "provisioned" - engine_version = "16.6" + engine_version = "16.15" database_name = local.db_name master_username = "substratal" manage_master_user_password = true # Secrets Manager–managed; the Data API authenticates with it