Only auto-approve the Terraform apply on workflow_dispatch

.github/workflows/terraform-apply.yaml

@@ -6,6 +6,10 @@ on:
       - main  # or any other branch you want to trigger the deployment
     paths: 
       - '**/*.tf'
+  # Recovery path for the approval gate below. When a merge-triggered apply fails
+  # with plan-changed, re-running it from the Actions tab replays the same push
+  # event and fails identically, so a manual trigger is the only way back.
+  workflow_dispatch:
 
 jobs:
   terraform-apply:
@@ -34,4 +38,4 @@ jobs:
       with:
         path: terraform
         backend_config_file: terraform/prod.backend.tfvars
-        auto_approve: true
+        auto_approve: ${{ github.event_name == 'workflow_dispatch' }}

terraform/aws-gha-oidc-providers.tf

@@ -12,6 +12,14 @@
 // hackforla/devops-security#182.
 //
 // Do not "fix" their absence by adding them below.
+//
+// The apply role's sub condition is refs/heads/main ONLY, and that narrowness is
+// load-bearing beyond the obvious. terraform-apply.yaml has a workflow_dispatch
+// trigger whose runs are auto-approved -- the one path that applies without a
+// reviewed plan -- and a dispatch on any other branch presents a different sub,
+// so AWS refuses the AssumeRole outright. Widening this to refs/heads/* would
+// silently turn that recovery trigger into an unreviewed apply from any branch.
+// See hackforla/devops-security#187.
 
 module "iam_oidc_gha_incubator" {
   source = "./modules/aws-gha-oidc-providers"