From 599e55157ad552f611744aabfd62cad5644178be Mon Sep 17 00:00:00 2001
From: Alex English <alex.english80@gmail.com>
Date: Sat, 5 Sep 2026 20:44:41 -0700
Subject: [PATCH] Only auto-approve the Terraform apply on workflow_dispatch

---
 .github/workflows/terraform-apply.yaml | 6 +++++-
 terraform/aws-gha-oidc-providers.tf    | 8 ++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/terraform-apply.yaml b/.github/workflows/terraform-apply.yaml
index 5ff1e1f..2857f8b 100644
--- a/.github/workflows/terraform-apply.yaml
+++ b/.github/workflows/terraform-apply.yaml
@@ -6,6 +6,10 @@ on:
       - main  # or any other branch you want to trigger the deployment
     paths: 
       - '**/*.tf'
+  # Recovery path for the approval gate below. When a merge-triggered apply fails
+  # with plan-changed, re-running it from the Actions tab replays the same push
+  # event and fails identically, so a manual trigger is the only way back.
+  workflow_dispatch:
 
 jobs:
   terraform-apply:
@@ -34,4 +38,4 @@ jobs:
       with:
         path: terraform
         backend_config_file: terraform/prod.backend.tfvars
-        auto_approve: true
+        auto_approve: ${{ github.event_name == 'workflow_dispatch' }}
diff --git a/terraform/aws-gha-oidc-providers.tf b/terraform/aws-gha-oidc-providers.tf
index 6275d59..4323869 100644
--- a/terraform/aws-gha-oidc-providers.tf
+++ b/terraform/aws-gha-oidc-providers.tf
@@ -12,6 +12,14 @@
 // hackforla/devops-security#182.
 //
 // Do not "fix" their absence by adding them below.
+//
+// The apply role's sub condition is refs/heads/main ONLY, and that narrowness is
+// load-bearing beyond the obvious. terraform-apply.yaml has a workflow_dispatch
+// trigger whose runs are auto-approved -- the one path that applies without a
+// reviewed plan -- and a dispatch on any other branch presents a different sub,
+// so AWS refuses the AssumeRole outright. Widening this to refs/heads/* would
+// silently turn that recovery trigger into an unreviewed apply from any branch.
+// See hackforla/devops-security#187.
 
 module "iam_oidc_gha_incubator" {
   source = "./modules/aws-gha-oidc-providers"