feat: support use_immutable_subject and sub_claim_prefix on repository OIDC subject claim template - #3582
Conversation
…y OIDC subject claim template Wires the use_immutable_subject and sub_claim_prefix fields (already present on go-github v89's OIDCSubjectClaimCustomTemplate struct) through the github_actions_repository_oidc_subject_claim_customization_template resource, allowing existing repositories to opt into GitHub's immutable OIDC subject claim format on a per-repository basis without an org-wide change. Closes integrations#3548
|
👋 Hi, and thank you for this contribution! This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can. You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions. 🤖 This is an automated message. |
|
Just an FYI, I got bit by this today trying to resolve an issue with a new microservice's OIDC config. The API publishes In this older repo, the UI and API agree: 
╰─❯ gh api /repos/BuyerQuest/redacted-old-repo/actions/oidc/customization/sub
{
"use_default": true,
"use_immutable_subject": false,
"sub_claim_prefix": "repo:BuyerQuest/redacted-old-repo"
}But this newer repo created after the compulsive switchover they disagree entirely: 
gh api /repos/BuyerQuest/redacted-new-repo/actions/oidc/customization/sub
{
"use_default": true,
"use_immutable_subject": false,
"sub_claim_prefix": "repo:BuyerQuest@123445689/redacted-new-repo@987654321"
}I bring this up because what I wanted to do was inspect the true/false of I'm using this as a workaround: data "github_repository" "this" {
full_name = "${local.github_org}/${var.github_repository}"
}
data "github_rest_api" "repo_oidc" {
endpoint = "repos/${data.github_repository.this.full_name}/actions/oidc/customization/sub"
}
module "github_actions_role" {
source = "philips-labs/github-oidc/aws"
version = "0.8.1"
openid_connect_provider_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
repo = data.github_repository.this.full_name
role_name = "${local.name_prefix}-deploy"
role_path = "/github-actions/"
default_conditions = [
"deny_pull_request",
]
// GitHub reports the exact prefix it uses for this repository. This handles both the
// name-based and immutable name@id formats without duplicating GitHub's selection logic.
conditions = [
{
test = "StringEquals"
variable = "token.actions.githubusercontent.com:sub"
values = [
"${jsondecode(data.github_rest_api.repo_oidc.body).sub_claim_prefix}:environment:${github_repository_environment.this.environment}",
]
},
]Unless I'm mistaken, for the data source it may be worth computing it based on the qualities of |
Summary
Wires
use_immutable_subjectandsub_claim_prefix— already present on go-github v89'sOIDCSubjectClaimCustomTemplatestruct — through togithub_actions_repository_oidc_subject_claim_customization_template.This lets a repository created before GitHub's July 15, 2026 immutable-subject-claims rollout opt in individually via Terraform, instead of requiring an org-wide toggle or an out-of-band REST call that Terraform can't track.
Changes
use_immutable_subject(bool, optional, computed) andsub_claim_prefix(string, optional, computed) added to the resource schemaCreateOrUpdateandRead, following the existingGetOk+new(...)pattern already used elsewhere in this resource (include_claim_keys) and in sibling resources (e.g.resource_github_enterprise_actions_workflow_permissions.go)docs/resources/...mdand its.tmplsource) and the example underexamples/resources/...updated to cover both new argumentsScoped to the repository-level resource only, matching the issue — the organization-level resource and this resource's
Deletebehavior are unchanged.Closes #3548
Test plan
TestAccGithubActionsRepositoryOIDCSubjectClaimCustomizationTemplate), since these require a live GitHub token this environment doesn't haveuse_default/include_claim_keysandcan_approve_pull_request_reviewspatterns for consistency