shahar1 opened a new pull request, #81: URL: https://github.com/apache/airflow-ci-infra/pull/81
[INFRA-28572](https://issues.apache.org/jira/browse/INFRA-28572) asked Infra to opt this repository into GitHub's immutable OIDC subject. Instead, Infra merged apache/infrastructure-asfyaml#141, which adds `github.oidc_subject` to `.asf.yaml`, so we can set it ourselves. - `.asf.yaml`: `oidc_subject.use_immutable_subject: true`. - `terraform/runs-on-access`: the README and the `main.tf` comment now point at `.asf.yaml` instead of the Infra ticket. Comment only, nothing to apply. The roles in `terraform/runs-on-access` have trusted both the default and the immutable subject since #68, and they pin the repository by ID, so the switch keeps every workflow working. **Before merging:** wait until Infra confirms that #141 is deployed. `.asf.yaml` only runs on a push that changes it, so a merge before then needs another `.asf.yaml` push. **After merging**, check: ```bash gh api repos/apache/airflow-ci-infra/actions/oidc/customization/sub ``` Expect `"use_immutable_subject": true` and `"sub_claim_prefix": "repo:apache@47359/airflow-ci-infra@321691041"`. After one green pull-request plan and one green apply on `main` with the new form, a follow-up PR drops the default prefix (README, "Switching to the immutable subject"). --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
