Teach the OIDC subject format that GitHub now sends

instruction/awsEcr/awsEcr.md

@@ -45,12 +45,14 @@ In order for the `jwt-pizza-service` CI workflow to make requests over the OIDC-
 1. Select the `github-ci` role that you created when you set up `jwt-pizza` to deploy to S3.
 1. Select the **Trust relationships** tab.
 1. Click **Edit trust policy**.
-1. Replace the `token.actions.githubusercontent.com:sub` value with the following array. This allows both of your source repositories to make an OIDC connection. Replace `YOURGITHUBACCOUNTHERE` with your actual GitHub username.
+1. Replace the `StringLike` condition with the following so that both of your source repositories can make an OIDC connection. Fill in your account name and account ID, and the repository ID of each fork. You can read each one from `https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza` and `https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza-service`.
    ```json
-   "token.actions.githubusercontent.com:sub": [
-     "repo:YOURGITHUBACCOUNTHERE/jwt-pizza:ref:refs/heads/main",
-     "repo:YOURGITHUBACCOUNTHERE/jwt-pizza-service:ref:refs/heads/main"
-   ],
+   "StringLike": {
+     "token.actions.githubusercontent.com:sub": [
+       "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*",
+       "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza-service@JWTPIZZASERVICEREPOID:*"
+     ]
+   },
    ```
 1. Click the **Update policy** button.
 

instruction/awsS3Deployment/awsS3Deployment.md

@@ -111,6 +111,37 @@ Now, create the IAM role that GitHub Actions will assume.
 1. Name the role `github-ci`.
 1. Click **Create role**.
 
+### Set the trust policy subject
+
+The role wizard writes the subject claim using your account and repository names alone. GitHub also includes immutable numeric IDs in that claim for every repository created after July 15, 2026, and for any account or repository renamed after that date. Without the IDs the claim will not match and your deployment fails with `Not authorized to perform sts:AssumeRoleWithWebIdentity`.
+
+Find both IDs by opening the following URL in your browser, replacing `YOURGITHUBACCOUNT` with your GitHub account name.
+
+```txt
+https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza
+```
+
+The repository ID is the `id` field at the top. Your account ID is the `id` field inside `owner`.
+
+1. In the IAM console, open the `github-ci` role.
+1. Select the **Trust relationships** tab and click **Edit trust policy**.
+1. Replace the `Condition` object with the following, filling in your account name, account ID, and repository ID.
+
+   ```json
+   "Condition": {
+     "StringEquals": {
+       "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+     },
+     "StringLike": {
+       "token.actions.githubusercontent.com:sub": "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*"
+     }
+   }
+   ```
+
+1. Click **Update policy**.
+
+The subject has to sit under `StringLike` rather than `StringEquals`, because `StringEquals` treats the trailing `*` as a literal character and never matches. That wildcard covers whichever branch or environment the workflow runs under. Both IDs stay the same even if you rename your account or your fork.
+
 ### Configure GitHub Actions
 
 The final step is to create a GitHub Actions workflow that deploys to S3 using the OIDC credentials.

instruction/faq/faq.md

@@ -73,48 +73,32 @@ If you can do this, then you know your database is working, your username and pa
 
 ### Updating Trust Relationship
 
-In the rare case you have changed your GitHub username, you'll need to update the `Trust relationship` for your IAM role.
+If your IAM role was created before the [S3 deployment instruction](../awsS3Deployment/awsS3Deployment.md#set-the-trust-policy-subject) began setting repository IDs, or you have renamed your GitHub account or your fork since, the `Trust relationship` for your IAM role needs updating.
 
-If you currently deploy, you'll see an error in the `Create OIDC token to AWS`
+You will see this error in the `Create OIDC token to AWS` step:
 
 ```Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity```
 
 This is because GitHub includes stable numeric IDs in the subject claim to prevent future impersonation if the old username is ever reclaimed by someone else.
 
-In order to fix this, you'll need to add the following to Trust relationship of your IAM Role.
+Find both IDs by opening the following URL in your browser, replacing `YOURACCOUNTHERE` with your GitHub account name.
 
-1. Your GitHub account ID
-1. Your `jwt-pizza` repository ID
+- https://api.github.com/repos/YOURACCOUNTHERE/jwt-pizza
 
-#### GitHub Id
+The repository ID is the `id` field at the top of the page. Your account ID is the `id` field inside `owner`.
 
-1. Go to the following URL and replace YOURACCOUNTHERE with your current GitHub account (i.e. byucsstudent)
-- https://api.github.com/users/YOURACCOUNTHERE
-2. From there, find the "id" section and copy it.
-- i.e. ```"id": 159643410```
+With both IDs, go to AWS -> IAM -> Roles. Open your role (i.e. `github-ci`), select `Trust relationships`, and click `Edit trust policy`. The subject claim needs to carry both IDs, and it has to sit under `StringLike` rather than `StringEquals`, because `StringEquals` treats the trailing `*` as a literal character and never matches.
 
-#### Repository ID
-
-1. Go to your `jwt-pizza` repository on GitHub and on the main page (i.e. https://github.com/byucsstudent/jwt-pizza)
-1. Right click and select `View page source`
-1. Use Ctrl-F to and find "repository:"
-1. Copy the 10-digit ID that is in the meta tag
-- ```<meta name="hovercard-subject-tag" content="repository:1355254320" data-turbo-transient>```
-
-#### Updating Trust Relationship
-
-With both IDs, go to AWS -> IAM -> Roles. Go to the recently created role (i.e. `github-ci`). Then navigate to `Trust relationships`.
-
-In the JSON, look for the section called `StringEquals`, specifically in the `token.actions.githubusercontent.com:sub` section.
-The current format follows `repo:OWNER/REPO:ref:refs/heads/BRANCH`.
-
-Click `Edit trust policy`.
-
-You need to include your GitHub id and repository id to these sections so it appears like this
-
-`repo:owner@id/repo@repo-id:re:refs/heads/BRANCH`
-
-Example: `repo:byucsstudent@159643410/jwt-pizza@1355254320:ref:refs/head/main`
+```json
+"Condition": {
+  "StringEquals": {
+    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+  },
+  "StringLike": {
+    "token.actions.githubusercontent.com:sub": "repo:byucsstudent@159643410/jwt-pizza@1355254320:*"
+  }
+}
+```
 
 Click `Update policy`.
 

instruction/gitHubEnvironments/gitHubEnvironments.md

@@ -53,7 +53,7 @@ For your CI workflow to access AWS using the IAM role you created previously, yo
 
 1. Open the **IAM dashboard** in the AWS Console.
 2. Locate and edit the `github-ci` role.
-3. Update the `Condition` object in the **Trust relationship** to include the `environment:production` string in the `sub` (subject) claim.
+3. Confirm the `Condition` object in the **Trust relationship** matches the following. The wildcard at the end of each subject already covers the `environment:production` claim that your workflow sends once it runs in the production environment.
 
 ```json
 {
@@ -67,11 +67,12 @@ For your CI workflow to access AWS using the IAM role you created previously, yo
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
         "StringEquals": {
-          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+        },
+        "StringLike": {
           "token.actions.githubusercontent.com:sub": [
-            "repo:YOURGITHUBACCOUNTNAME/jwt-pizza:environment:production",
-            "repo:YOURGITHUBACCOUNTNAME/jwt-pizza:ref:refs/heads/main",
-            "repo:YOURGITHUBACCOUNTNAME/jwt-pizza-service:ref:refs/heads/main"
+            "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*",
+            "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza-service@JWTPIZZASERVICEREPOID:*"
           ]
         }
       }