chore(tf): harden oidc claims validation (#171)

jsr-io · Mar 4, 2024 · 46286e2 · 46286e2
1 parent a1cbc78
commit 46286e2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/terraform/oidc.tf b/terraform/oidc.tf
@@ -17,7 +17,7 @@ resource "google_iam_workload_identity_pool_provider" "github_actions" {
     "attribute.repository"  = "assertion.repository"
     "attribute.environment" = "assertion.environment"
   }
-  attribute_condition = "assertion.repository == 'jsr-io/jsr'"
+  attribute_condition = "assertion.repository == 'jsr-io/jsr' && assertion.environment == '${var.production ? "prod" : "staging"}'"
 }
 
 resource "google_service_account" "github_actions" {