fix: allow tfroot-twilio SOPS OIDC

[xnoto]

Summary

Allow the existing multi-root github-actions-sops-kms role to accept the exact makeitworkcloud/tfroot-twilio repository subject pattern. The bootstrap plan in tfroot-twilio PR #1 currently fails before OpenTofu runs because that repository is not in the role trust policy.

The added pattern is scoped to this one repository and matches the established standard-subject form already used by the existing OpenTofu roots. The role remains KMS-only; no S3 state access or Twilio API access is added.

Fixes # N/A — unblocks validation of the no-resource Twilio root bootstrap.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none are changed.

The failed Twilio-root plan 33813787580 establishes the blocker: sts:AssumeRoleWithWebIdentity is denied before the plan step. No local OpenTofu, SOPS, state, import, plan, or apply operations were run.

Impact and rollout

Producer: tfroot-aws owns the trust policy for github-actions-sops-kms.

Consumer: only tfroot-twilio is newly allowed to assume that existing KMS role. It remains unable to operate Twilio, read/write state through this change, or affect other repositories. After this PR's CI passes and an explicitly authorized merge applies it, rerun/replace the Twilio-root PR validation to confirm its no-resource plan. A later change still needs encrypted backend inputs and dedicated state access before any Twilio provider configuration.

Rollback is a reviewed revert of this single subject entry; do not broaden to an organization wildcard.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI agent materially produced this change; reviewers should confirm the single-repository scope and retained KMS-only permission boundary.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike   = {
[REDACTED: potentially sensitive plan output]
                                    # (4 unchanged elements hidden)
                                    "repo:makeitworkcloud@195502628/tfroot-namecheap@1349145005:*",
                                  + "repo:makeitworkcloud/tfroot-twilio:*",
                                ]
                            }
                            # (1 unchanged attribute hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        tags                  = {
            "ManagedBy" = "Terraform"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike   = {
[REDACTED: potentially sensitive plan output]
                                    # (4 unchanged elements hidden)
                                    "repo:makeitworkcloud@195502628/tfroot-namecheap@1349145005:*",
                                  + "repo:makeitworkcloud/tfroot-twilio:*",
                                ]
                            }
                            # (1 unchanged attribute hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        tags                  = {
            "ManagedBy" = "Terraform"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.