fix: match tfroot-twilio OIDC subject

[xnoto]

Summary

Replace the just-applied human-readable tfroot-twilio trust pattern with the exact organization/repository-ID subject emitted by its GitHub Actions OIDC token: repo:makeitworkcloud@195502628/tfroot-twilio@1356437102:pull_request.

The repository's bootstrap plan still fails because the subject format differs from the older roots. A temporary, secret-free diagnostic job emitted only this non-sensitive claim; it is removed from the Twilio-root branch before merge.

Fixes # N/A — restore the intended single-repository KMS OIDC trust boundary.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — OpenTofu test and plan succeeded.
• OpenTofu plan changes only github-actions-sops-kms: 0 to add, 1 to change, 0 to destroy.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none are changed.

The failed revalidation in tfroot-twilio PR #1 established that the initial subject pattern does not match. Its temporary diagnostic job emitted the exact repository-scoped subject without exposing a token. No local OpenTofu, SOPS, state, import, plan, or apply operations were run.

Impact and rollout

Producer: tfroot-aws owns the github-actions-sops-kms trust policy.

Consumer: only tfroot-twilio is affected. This replaces one repository-scoped subject expression with the exact repository-ID-qualified expression; it does not add repositories, widen permissions, grant S3 state access, or grant Twilio API access. After a confirmed merge and successful environment-gated apply, rerun the no-resource Twilio-root plan. Its merge remains separately confirmation-gated.

Rollback is a reviewed revert of this one subject expression. Do not use an organization wildcard.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI agent materially produced this change; reviewers should confirm the exact claim evidence, no added repository scope, and retained KMS-only permission boundary.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike   = {
[REDACTED: potentially sensitive plan output]
                                    # (4 unchanged elements hidden)
                                    "repo:makeitworkcloud@195502628/tfroot-namecheap@1349145005:*",
                                  - "repo:makeitworkcloud/tfroot-twilio:*",
                                  + "repo:makeitworkcloud@195502628/tfroot-twilio@1356437102:*",
                                ]
                            }
                            # (1 unchanged attribute hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        tags                  = {
            "ManagedBy" = "Terraform"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ StringLike   = {
[REDACTED: potentially sensitive plan output]
                                    # (4 unchanged elements hidden)
                                    "repo:makeitworkcloud@195502628/tfroot-namecheap@1349145005:*",
                                  - "repo:makeitworkcloud/tfroot-twilio:*",
                                  + "repo:makeitworkcloud@195502628/tfroot-twilio@1356437102:*",
                                ]
                            }
                            # (1 unchanged attribute hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        tags                  = {
            "ManagedBy" = "Terraform"
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.