Repair GitHub OIDC Cloud Role Audience Mismatch

Repair GitHub OIDC Cloud Role Audience Mismatch — EVIDENCE-LIMITED REVIEW

Scenario received

A release workflow loses access to cloud deployments after environment names are renamed.

Evidence inventory

• S1: workflow token claim metadata — partial extract described by the requester; original full source not provided here.
• S2: cloud trust policy definitions — partial extract described by the requester; original full source not provided here.
• S3: runner job context — NOT PROVIDED; required to validate dependent findings.
• S4: denied role assumption logs — NOT PROVIDED; required to validate dependent findings.

Case-specific checks

Compare audience and subject predicates. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
2.

Inspect environment scoped claims. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
3.

Identify trust policy overbreadth. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
4.

Test least privilege role assumptions. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.

Deliverables

Claim mismatch analysis. Create an evidence-linked section with observations, missing data, owner and next validation step.

Minimal trust correction. Create an evidence-linked section with observations, missing data, owner and next validation step.

Negative authorization test plan. Create an evidence-linked section with observations, missing data, owner and next validation step.

Acceptance gate

The correction restores only intended identities and never broadens trust to arbitrary repositories. Do not label this gate passed until supplied source records actually demonstrate it.

Verdict and next action

INCOMPLETE — evidence required. Request S3 and S4 from the authorized owner, reconcile them with S1 and S2, then repeat the four checks and log remaining conflicts. No production change, approval, communication, or test run is claimed.