Separate the roles for plan and apply

How to do it

Pull request code may come from anyone with push rights, so its role must not change anything. Bind each role's trust to the event, branch or environment in the OIDC token, as in OIDC for CI. An environment claim proves only the environment, so limit the production environment's deployment branches to main in the code host. The apply role may not change its own trust policy or the audit trail. The app's runtime role has no rights over infrastructure.

Example

# Plan role: pull request jobs only
condition {
  test     = "StringEquals"
  variable = "token.actions.githubusercontent.com:sub"
  values   = ["repo:example/shop:pull_request"]
}

# Apply role: only jobs in the production environment, which allows only the main branch
condition {
  test     = "StringEquals"
  variable = "token.actions.githubusercontent.com:sub"
  values   = ["repo:example/shop:environment:production"]
}

How to check

A pull request job that tries to assume the apply role gets AccessDenied. The plan role's policy holds only read actions.