fix(iam): pin javabin-ci-infra to platform-ci.yml on main

.github/workflows/platform-ci.yml

@@ -260,7 +260,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/javabin-ci-infra
+          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/javabin-ci-infra-plan
           aws-region: ${{ env.AWS_REGION }}
           role-session-name: ${{ env.SESSION_NAME }}
 

docs/ci-workflow.md

@@ -32,9 +32,11 @@ Monday 08:00   ──► securityhub-summary Lambda ──► #javabin-infra-ale
 - Downloads plan from S3, verifies SHA256 integrity
 - `terraform apply -auto-approve tfplan`
 - Uses `environment: production` (GitHub environment protection)
+- OIDC → `javabin-ci-infra`. The role's trust also pins `job_workflow_ref` to `platform-ci.yml@refs/heads/main`, because the environment-based `sub` claim carries no branch. A workflow on another branch that declares `environment: production` cannot assume it.
 
 ### drift
 - Weekly schedule (Monday 06:00 UTC)
+- OIDC → `javabin-ci-infra-plan` (read-only; drift never applies)
 - Runs `terraform plan -detailed-exitcode`
 - If drift detected, posts to Slack with plan output
 

docs/platform-modules.md

@@ -47,10 +47,11 @@ GitHub OIDC provider (data source), CI roles, permission boundary, ECS execution
 
 | Role | Trust | Purpose |
 |------|-------|---------|
-| `javabin-ci-infra` | platform repo, main branch | Apply platform TF |
-| `javabin-ci-infra-plan` | platform repo, main branch + PRs | Read-only plan + review for platform TF |
-| `javabin-ci-app-{repo}` | Per-app, pinned to `tf-plan.yml` | App TF plan + apply |
-| `javabin-ci-deploy-{repo}` | Per-app, pinned to `tf-apply.yml` | ECR push, ECS deploy |
+| `javabin-ci-infra` | platform repo, pinned to `platform-ci.yml@refs/heads/main` | Apply platform TF (apply job only) |
+| `javabin-ci-infra-plan` | platform repo, any branch / PR (`repo:javaBin/platform:*`) | Read-only plan + review + weekly drift check for platform TF |
+| `javabin-ci-app-broker` | Any org repo, pinned to the platform's reusable workflows on `main` | Invoke the CI broker Lambda only |
+| `javabin-ci-team-{team}` | CI broker and apply gate Lambdas (not OIDC) | Team TF plan + apply, scoped to the team by the developer boundary |
+| `javabin-ci-deploy-{team}` | CI broker Lambda (not OIDC) | ECR push, ECS deploy |
 | `javabin-ci-override-approver` | Board members, pinned to `approve-override.yml` | SSM override tokens |
 | `javabin-ci-registry` | Registry repo | Team provisioning dispatch |
 | `javabin-ecs-execution` | ECS tasks | Pull images, write logs, read secrets |

terraform/platform/iam/main.tf

@@ -149,7 +149,7 @@ resource "aws_iam_role_policy" "ci_infra_plan_extras" {
 ################################################################################
 # 1b. javabin-ci-infra — Platform repo apply only
 #
-# Trust: GitHub OIDC, ONLY main branch (not PRs).
+# Trust: GitHub OIDC, ONLY platform-ci.yml on main (job_workflow_ref pin).
 # Permissions: Allow *:* with permission boundary + explicit deny on operations
 # that should never happen via CI (organizations, IAM users, destructive security ops).
 ################################################################################
@@ -172,13 +172,18 @@ resource "aws_iam_role" "ci_infra" {
             "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
           }
           StringLike = {
-            # Main branch OR production environment — the apply job uses
-            # `environment: production`, which changes the OIDC sub claim
-            # from ref-based to environment-based.
+            # The apply job uses `environment: production`, which changes the
+            # OIDC sub claim from ref-based to environment-based. That sub
+            # carries no branch, so on its own any branch that declares the
+            # environment would match.
             "token.actions.githubusercontent.com:sub" = [
               "repo:${var.github_org}/platform:ref:refs/heads/main",
               "repo:${var.github_org}/platform:environment:production",
             ]
+            # The job_workflow_ref pin is what ties this role to main: only
+            # platform-ci.yml as committed on main can assume it, whatever
+            # the environment's branch policy says.
+            "token.actions.githubusercontent.com:job_workflow_ref" = "${var.github_org}/platform/.github/workflows/platform-ci.yml@refs/heads/main"
           }
         }
       }