From 378bf771ba23ad9931decab9b53f695a987b2ebb Mon Sep 17 00:00:00 2001 From: Richard Cheney Date: Thu, 23 Jul 2026 14:45:51 +0100 Subject: [PATCH 1/4] immutable subject claim --- modules/github/locals.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/github/locals.tf b/modules/github/locals.tf index b8d5b9a7..14cb36b9 100644 --- a/modules/github/locals.tf +++ b/modules/github/locals.tf @@ -25,7 +25,7 @@ locals { { subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key - subject = "repo:${var.organization_name}/${var.repository_name}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" + subject = "repo:${var.organization_name}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" } ] ]) From 7c17aefb7f072f027f13b6d16f9fb58538f07d30 Mon Sep 17 00:00:00 2001 From: Daniel Boring <30814950+DanielBoring@users.noreply.github.com> Date: Fri, 24 Apr 2026 17:22:45 -0400 Subject: [PATCH 2/4] fix(github): use API-resolved org login for OIDC subject claims Use data.github_organization.alz.login instead of var.organization_name when constructing OIDC subject claims for federated credentials. This preserves exact org casing in the repo: segment to match GitHub token assertions and avoid AADSTS7002138 case-sensitive matching failures. Also lower-case the org in job_workflow_ref template composition to align with observed GitHub token behavior for reusable workflow refs. --- modules/github/locals.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/github/locals.tf b/modules/github/locals.tf index 14cb36b9..2176fc66 100644 --- a/modules/github/locals.tf +++ b/modules/github/locals.tf @@ -18,14 +18,14 @@ locals { locals { repository_name_templates = var.use_template_repository ? var.repository_name_templates : var.repository_name - template_claim_structure = "${var.organization_name}/${local.repository_name_templates}/%s@refs/heads/main" + template_claim_structure = "${lower(data.github_organization.alz.login)}/${local.repository_name_templates}/%s@refs/heads/main" oidc_subjects_flattened = flatten([for key, value in var.workflows : [ for environment_user_assigned_managed_identity_mapping in value.environment_user_assigned_managed_identity_mappings : { subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key - subject = "repo:${var.organization_name}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" + subject = "repo:${data.github_organization.alz.login}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" } ] ]) From 47a6658db7129a4a93d11c16e13498536fd5242a Mon Sep 17 00:00:00 2001 From: Yingjie Date: Thu, 30 Jul 2026 16:12:53 +0800 Subject: [PATCH 3/4] Support legacy and immutable OIDC subjects Generate both legacy name-based and immutable ID-based GitHub Actions OIDC subject claims for each workflow and environment mapping. Keep the legacy subject on the existing key and add an immutable subject with a distinct key. This preserves authentication for existing repositories while supporting repositories that use GitHub's immutable OIDC subject format. --- modules/github/locals.tf | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/modules/github/locals.tf b/modules/github/locals.tf index 2176fc66..ccdd1811 100644 --- a/modules/github/locals.tf +++ b/modules/github/locals.tf @@ -20,13 +20,28 @@ locals { repository_name_templates = var.use_template_repository ? var.repository_name_templates : var.repository_name template_claim_structure = "${lower(data.github_organization.alz.login)}/${local.repository_name_templates}/%s@refs/heads/main" + # The "repo:" segment of the OIDC subject has two formats: + # - immutable: Includes numeric IDs for repositories created after 2026-07-15. + # https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens + # - legacy: Name-based format still issued by repositories that have not enabled immutable subjects. + oidc_repo_claim_immutable = "repo:${data.github_organization.alz.login}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}" + oidc_repo_claim_legacy = "repo:${data.github_organization.alz.login}/${var.repository_name}" + + # Add legacy and immutable subjects for each workflow/environment so authentication + # remains compatible regardless of the repository's immutable-subject setting. oidc_subjects_flattened = flatten([for key, value in var.workflows : [ - for environment_user_assigned_managed_identity_mapping in value.environment_user_assigned_managed_identity_mappings : - { - subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" - user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key - subject = "repo:${data.github_organization.alz.login}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" - } + for environment_user_assigned_managed_identity_mapping in value.environment_user_assigned_managed_identity_mappings : [ + { + subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" + user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key + subject = "${local.oidc_repo_claim_legacy}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" + }, + { + subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}-immutable" + user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key + subject = "${local.oidc_repo_claim_immutable}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" + }, + ] ] ]) From cd323b5f16bedc2d823d7db5306d83ea50158879 Mon Sep 17 00:00:00 2001 From: Qi Zhang Date: Fri, 31 Jul 2026 15:23:15 +0800 Subject: [PATCH 4/4] Revert "Support legacy and immutable OIDC subjects" --- modules/github/locals.tf | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-) diff --git a/modules/github/locals.tf b/modules/github/locals.tf index ccdd1811..2176fc66 100644 --- a/modules/github/locals.tf +++ b/modules/github/locals.tf @@ -20,28 +20,13 @@ locals { repository_name_templates = var.use_template_repository ? var.repository_name_templates : var.repository_name template_claim_structure = "${lower(data.github_organization.alz.login)}/${local.repository_name_templates}/%s@refs/heads/main" - # The "repo:" segment of the OIDC subject has two formats: - # - immutable: Includes numeric IDs for repositories created after 2026-07-15. - # https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens - # - legacy: Name-based format still issued by repositories that have not enabled immutable subjects. - oidc_repo_claim_immutable = "repo:${data.github_organization.alz.login}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}" - oidc_repo_claim_legacy = "repo:${data.github_organization.alz.login}/${var.repository_name}" - - # Add legacy and immutable subjects for each workflow/environment so authentication - # remains compatible regardless of the repository's immutable-subject setting. oidc_subjects_flattened = flatten([for key, value in var.workflows : [ - for environment_user_assigned_managed_identity_mapping in value.environment_user_assigned_managed_identity_mappings : [ - { - subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" - user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key - subject = "${local.oidc_repo_claim_legacy}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" - }, - { - subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}-immutable" - user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key - subject = "${local.oidc_repo_claim_immutable}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" - }, - ] + for environment_user_assigned_managed_identity_mapping in value.environment_user_assigned_managed_identity_mappings : + { + subject_key = "${key}-${environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key}" + user_assigned_managed_identity_key = environment_user_assigned_managed_identity_mapping.user_assigned_managed_identity_key + subject = "repo:${data.github_organization.alz.login}@${data.github_organization.alz.id}/${var.repository_name}@${github_repository.alz.repo_id}:environment:${var.environments[environment_user_assigned_managed_identity_mapping.environment_key]}:job_workflow_ref:${format(local.template_claim_structure, value.workflow_file_name)}" + } ] ])