{
  "id": "infra-stack/github-actions-oidc-deploy",
  "slug": "github-actions-oidc-deploy",
  "title": "Session: github-actions-oidc-deploy — 2026-09-14",
  "type": "source",
  "project": "infra-stack",
  "date": "2026-09-14",
  "started": "2026-09-14T13:20:00+00:00",
  "ended": "2026-09-14T14:26:00+00:00",
  "model": "gpt-5",
  "cwd": "/home/dev/code/infra-stack",
  "git_branch": "feat/oidc-deploy",
  "permission_mode": "default",
  "user_messages": 1,
  "tool_calls": 3,
  "tools_used": [
    "Bash",
    "Edit",
    "Write"
  ],
  "is_subagent": false,
  "wikilinks_out": [
    "GitHubActions",
    "LeastPrivilege",
    "OIDC",
    "infra-stack"
  ],
  "body_text": "Project: infra-stack · Branch: feat/oidc-deploy · Mode: default · Model: gpt-5\n\nSummary\n\nReplaced long-lived AWS keys in CI with GitHub Actions OIDC: an IAM role trusted only for this repo's main branch and environment, scoped to the deploy bucket and the EKS cluster.\n\nConversation\n\nTurn 1 — User\n\nGet rid of the AWS access keys in our GitHub secrets.\n\nTurn 1 — Assistant\n\nCreate an OIDC provider and a role whose trust policy pins repo:<org>/infra-stack:environment:prod. The workflow uses aws-actions/configure-aws-credentials with role-to-assume.\n\nTools used in this turn:\n\n- Write: iam/github-oidc.tf\n- Edit: .github/workflows/deploy.yml\n- Bash: terraform apply -target=module.github_oidc — 3 added\n\nConnections\n\n- infra-stack\n- GitHubActions\n- OIDC\n- LeastPrivilege",
  "sha256": "54e3875bc01b6551",
  "source_url": "sessions/infra-stack/2026-09-14-github-actions-oidc-deploy.html"
}