@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/git-policy/github-bootstrap.js

@@ -1,30 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EBK_CODE_OWNER_PLACEHOLDER = exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES = exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = exports.EBK_SMOKE_ROLE_SECRET = exports.EBK_RELIABILITY_READ_ROLE_SECRET = exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = exports.EBK_PERFORMANCE_COST_ROLE_SECRET = exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = exports.EBK_DEPLOYMENT_ROLE_SECRET = exports.EBK_REQUIRED_CHECKS = exports.EBK_PROTECTED_BRANCH_RULESET_NAME = void 0;
+exports.EBK_CODE_OWNER_PLACEHOLDER = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = exports.EBK_PERFORMANCE_COST_ROLE_SECRET = exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET = exports.EBK_REQUIRED_CHECKS = exports.EBK_PROTECTED_BRANCH_RULESET_NAME = void 0;
+exports.githubEnvironmentTopology = githubEnvironmentTopology;
 exports.runGitHubBootstrap = runGitHubBootstrap;
 const index_js_1 = require("../repository-policy/index.js");
 const deterministic_order_js_1 = require("../deterministic-order.js");
 exports.EBK_PROTECTED_BRANCH_RULESET_NAME = 'Empire Builder Kit protected branches';
 exports.EBK_REQUIRED_CHECKS = ['policy', 'verify'];
-exports.EBK_DEPLOYMENT_ROLE_SECRET = 'AWS_DEPLOY_ROLE_ARN';
+exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET = 'AWS_DEPLOY_ROLE_ARN';
 exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = 'AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN';
 exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = 'AWS_ASYNC_RECOVERY_ROLE_ARN';
 exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = 'AWS_PERFORMANCE_AGGREGATE_ROLE_ARN';
 exports.EBK_PERFORMANCE_COST_ROLE_SECRET = 'AWS_PERFORMANCE_COST_ROLE_ARN';
 exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = 'AWS_PERFORMANCE_LOAD_ROLE_ARN';
 exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = 'EBK_PERFORMANCE_ORIGINS_JSON';
-exports.EBK_RELIABILITY_READ_ROLE_SECRET = 'AWS_RELIABILITY_READ_ROLE_ARN';
-exports.EBK_SMOKE_ROLE_SECRET = 'AWS_SMOKE_ROLE_ARN';
 exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = 'AWS_STAGING_PROMOTION_PULL_ROLE_ARN';
 exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = [
     exports.EBK_ASYNC_RECOVERY_ROLE_SECRET,
-    exports.EBK_DEPLOYMENT_ROLE_SECRET,
     exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_COST_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET,
-    exports.EBK_RELIABILITY_READ_ROLE_SECRET,
-    exports.EBK_SMOKE_ROLE_SECRET,
+    exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET,
     exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET,
 ];
 exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = [
@@ -34,140 +28,99 @@ exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = [
     'AWS_STAGING_PROMOTION_REGION',
     'EBK_ALLOW_PRODUCTION_REMOVE',
     'EBK_FLEET_ORIGIN',
-    exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    'EBK_SMOKE_AUTHORITY_VERSION',
-    'EBK_SMOKE_TARGETS',
 ];
 const FORBIDDEN_NPM_TOKEN_NAMES = [
     'NODE_AUTH_TOKEN',
     'NPM_CONFIG_TOKEN',
     'NPM_TOKEN',
 ];
-exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES = [
-    'AWS_PRODUCTION_PLAN_EXPECTED_ACCOUNT_ID',
-    'AWS_PRODUCTION_PLAN_GENERATED_OBJECT_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_GENERATED_PARAMETER_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_GENERATED_SECRET_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_PROVIDER_REFRESH_POLICY_JSON',
-    'AWS_PRODUCTION_PLAN_REGION',
-    'AWS_PRODUCTION_PLAN_ROLE_ARN',
-    'AWS_PRODUCTION_PLAN_SST_APPS_JSON',
-    'AWS_PRODUCTION_PLAN_STATE_BUCKET_ARN',
-    'AWS_PRODUCTION_PLAN_STATE_KMS_KEY_ARN',
-    'EBK_PRODUCTION_FLEET_ORIGIN',
-];
-exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES = [
-    'AWS_STAGING_PLAN_EXPECTED_ACCOUNT_ID',
-    'AWS_STAGING_PLAN_GENERATED_OBJECT_ARNS_JSON',
-    'AWS_STAGING_PLAN_GENERATED_PARAMETER_ARNS_JSON',
-    'AWS_STAGING_PLAN_GENERATED_SECRET_ARNS_JSON',
-    'AWS_STAGING_PLAN_PROVIDER_REFRESH_POLICY_JSON',
-    'AWS_STAGING_PLAN_REGION',
-    'AWS_STAGING_PLAN_ROLE_ARN',
-    'AWS_STAGING_PLAN_SST_APPS_JSON',
-    'AWS_STAGING_PLAN_STATE_BUCKET_ARN',
-    'AWS_STAGING_PLAN_STATE_KMS_KEY_ARN',
-    'EBK_STAGING_FLEET_ORIGIN',
-];
 exports.EBK_CODE_OWNER_PLACEHOLDER = '@REPLACE_WITH_GITHUB_CODE_OWNER';
-const GITHUB_API_VERSION = '2022-11-28';
+const GITHUB_API_VERSION = '2026-03-10';
+const GITHUB_IMMUTABLE_OIDC_CHANGE = 'Use the default immutable GitHub OIDC repository subject.';
+const GITHUB_IMMUTABLE_OIDC_TRUST_ACKNOWLEDGEMENT_PREFIX = 'aws-trust-ready:';
 const PROTECTED_BRANCHES = ['develop', 'main'];
-const ENVIRONMENT_BRANCHES = {
-    'async-recovery-production': 'main',
-    'async-recovery-staging': 'develop',
-    'infrastructure-plan-production': 'main',
-    'infrastructure-plan-staging': 'develop',
-    'performance-cost-production': 'main',
-    'performance-cost-staging': 'develop',
-    'performance-aggregate-production': 'main',
-    'performance-aggregate-staging': 'develop',
-    'performance-load-production': 'main',
-    'performance-load-staging': 'develop',
-    'npm-prerelease': 'main',
-    production: 'main',
-    'reliability-read-production': 'main',
-    'reliability-read-staging': 'develop',
-    staging: 'develop',
-};
-const ENVIRONMENT_SECRET_REQUIREMENTS = {
-    'async-recovery-production': [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
-    'async-recovery-staging': [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
-    'infrastructure-plan-production': [],
-    'infrastructure-plan-staging': [],
-    'performance-cost-production': [exports.EBK_PERFORMANCE_COST_ROLE_SECRET],
-    'performance-cost-staging': [exports.EBK_PERFORMANCE_COST_ROLE_SECRET],
-    'performance-aggregate-production': [exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET],
-    'performance-aggregate-staging': [exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET],
-    'performance-load-production': [exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET],
-    'performance-load-staging': [exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET],
-    'npm-prerelease': [],
-    production: [
-        exports.EBK_DEPLOYMENT_ROLE_SECRET,
-        exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-        exports.EBK_SMOKE_ROLE_SECRET,
-        exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET,
-    ],
-    'reliability-read-production': [exports.EBK_RELIABILITY_READ_ROLE_SECRET],
-    'reliability-read-staging': [exports.EBK_RELIABILITY_READ_ROLE_SECRET],
-    staging: [
-        exports.EBK_DEPLOYMENT_ROLE_SECRET,
-        exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-        exports.EBK_SMOKE_ROLE_SECRET,
-    ],
-};
 const BASE_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES.filter((variable) => variable !== 'EBK_ALLOW_PRODUCTION_REMOVE' &&
-    variable !== exports.EBK_PERFORMANCE_ORIGINS_VARIABLE &&
     !variable.startsWith('AWS_STAGING_PROMOTION_'));
-const PRODUCTION_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES.filter((variable) => variable !== exports.EBK_PERFORMANCE_ORIGINS_VARIABLE);
-const ENVIRONMENT_VARIABLE_REQUIREMENTS = {
-    'async-recovery-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'async-recovery-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'infrastructure-plan-production': [],
-    'infrastructure-plan-staging': [],
-    'performance-cost-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-cost-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-aggregate-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-aggregate-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-load-production': [
-        'AWS_EXPECTED_ACCOUNT_ID',
-        'AWS_REGION',
-        exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    ],
-    'performance-load-staging': [
-        'AWS_EXPECTED_ACCOUNT_ID',
-        'AWS_REGION',
-        exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    ],
-    'npm-prerelease': [],
-    production: PRODUCTION_STAGE_VARIABLES,
-    'reliability-read-production': [],
-    'reliability-read-staging': [],
-    staging: BASE_STAGE_VARIABLES,
-};
-function environmentSecretRequirements(environment, deploymentProfile) {
-    const required = ENVIRONMENT_SECRET_REQUIREMENTS[environment];
-    return deploymentProfile === 'starter' && environment === 'production'
-        ? required.filter((secret) => secret !== exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET)
-        : required;
-}
-function environmentVariableRequirements(environment, deploymentProfile) {
-    const required = ENVIRONMENT_VARIABLE_REQUIREMENTS[environment];
-    return deploymentProfile === 'starter' && environment === 'production'
-        ? required.filter((variable) => !variable.startsWith('AWS_STAGING_PROMOTION_'))
-        : required;
-}
-function environmentStage(environment) {
-    return environment.endsWith('-production') ||
-        environment === 'npm-prerelease' ||
-        environment === 'production'
-        ? 'production'
-        : 'staging';
+const PRODUCTION_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES;
+const AUXILIARY_ENVIRONMENTS = Object.freeze([
+    {
+        name: 'async-recovery',
+        requiredSecrets: [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
+        requiredVariables: ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
+    },
+]);
+function stageEnvironmentTopology(stage, deploymentProfile) {
+    const production = stage === 'production';
+    return Object.freeze({
+        branch: production ? 'main' : 'develop',
+        name: stage,
+        requiredSecrets: Object.freeze(production
+            ? deploymentProfile === 'starter'
+                ? []
+                : [exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET]
+            : []),
+        requiredVariables: Object.freeze(production
+            ? deploymentProfile === 'starter'
+                ? PRODUCTION_STAGE_VARIABLES.filter((variable) => !variable.startsWith('AWS_STAGING_PROMOTION_'))
+                : PRODUCTION_STAGE_VARIABLES
+            : BASE_STAGE_VARIABLES),
+        stage,
+    });
+}
+/**
+ * Exact generated GitHub environment contract for one deployment profile.
+ * Starter uses development as its rehearsal stage; isolated profiles use
+ * staging. Production and npm publication remain present for every profile.
+ */
+function githubEnvironmentTopology(deploymentProfile) {
+    const rehearsalStage = deploymentProfile === 'starter' ? 'development' : 'staging';
+    const stages = [
+        'production',
+        rehearsalStage,
+    ];
+    const topology = [];
+    for (const auxiliary of AUXILIARY_ENVIRONMENTS) {
+        for (const stage of stages) {
+            topology.push(Object.freeze({
+                branch: stage === 'production' ? 'main' : 'develop',
+                name: `${auxiliary.name}-${stage}`,
+                requiredSecrets: Object.freeze([...auxiliary.requiredSecrets]),
+                requiredVariables: Object.freeze([...auxiliary.requiredVariables]),
+                stage,
+            }));
+        }
+    }
+    const ecrStages = deploymentProfile === 'starter'
+        ? ['production']
+        : ['staging', 'production'];
+    for (const stage of ecrStages) {
+        topology.push(Object.freeze({
+            branch: stage === 'production' ? 'main' : 'develop',
+            name: `ecr-inspector-${stage}`,
+            requiredSecrets: Object.freeze([
+                exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
+            ]),
+            requiredVariables: Object.freeze([
+                'AWS_EXPECTED_ACCOUNT_ID',
+                'AWS_REGION',
+            ]),
+            stage,
+        }));
+    }
+    topology.push(Object.freeze({
+        branch: 'main',
+        name: 'npm-prerelease',
+        requiredSecrets: Object.freeze([]),
+        requiredVariables: Object.freeze([]),
+        stage: 'production',
+    }), stageEnvironmentTopology('production', deploymentProfile), stageEnvironmentTopology(rehearsalStage, deploymentProfile));
+    return Object.freeze(topology);
 }
 function desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds) {
-    const current = state.environments[environment];
-    const stage = environmentStage(environment);
+    const current = state.environments[environment.name];
+    const stage = environment.stage;
     const stageEnvironment = state.environments[stage];
-    if (environment === 'npm-prerelease') {
+    if (environment.name === 'npm-prerelease') {
         if (productionApprovalMode === 'promotion-pr') {
             return {
                 preventSelfReview: false,
@@ -189,19 +142,29 @@ function desiredEnvironmentProtection(environment, state, productionApprovalMode
         preventSelfReview: stage === 'production' &&
             productionApprovalMode === 'environment-reviewer'
             ? true
-            : environment === stage
+            : environment.name === stage
                 ? current.preventSelfReview
                 : stageEnvironment.preventSelfReview,
         reviewers: stage === 'production' &&
             productionApprovalMode === 'environment-reviewer' &&
             productionReviewerIds.length > 0
             ? existingReviewerPayload(productionReviewerIds)
-            : environment === stage
+            : environment.name === stage
                 ? current.reviewers
                 : stageEnvironment.reviewers,
-        waitTimer: environment === stage ? current.waitTimer : stageEnvironment.waitTimer,
+        waitTimer: environment.name === stage
+            ? current.waitTimer
+            : stageEnvironment.waitTimer,
     };
 }
+function requiresImmutableOidcSubjectCutover(state) {
+    return Boolean(state.oidcSubjectCustomization &&
+        (!state.oidcSubjectCustomization.useDefault ||
+            !state.oidcSubjectCustomization.useImmutableSubject));
+}
+function immutableOidcTrustAcknowledgement(identity) {
+    return `${GITHUB_IMMUTABLE_OIDC_TRUST_ACKNOWLEDGEMENT_PREFIX}${identity.subjectPrefix}`;
+}
 const PRIVATE_ENVIRONMENT_REVIEWER_PLANS = new Set([
     'business_plus',
     'enterprise',
@@ -243,9 +206,10 @@ class GitHubApi {
             }
             throw new GitHubApiError(response.status, `GitHub ${method} ${path} failed (${response.status}): ${detail}`);
         }
-        if (response.status === 204)
+        const responseBody = await response.text();
+        if (!responseBody)
             return undefined;
-        return (await response.json());
+        return JSON.parse(responseBody);
     }
 }
 function parseRepository(repository) {
@@ -255,6 +219,58 @@ function parseRepository(repository) {
     }
     return { owner: match[1], repo: match[2] };
 }
+function inspectRepositoryIdentity(repo) {
+    const owner = typeof repo.owner === 'object' && repo.owner !== null
+        ? repo.owner
+        : undefined;
+    const ownerLogin = owner?.login;
+    const ownerId = owner?.id;
+    const repositoryName = repo.name;
+    const repositoryId = repo.id;
+    const fullName = repo.full_name;
+    if (typeof ownerLogin !== 'string' ||
+        !/^[A-Za-z0-9_.-]+$/u.test(ownerLogin) ||
+        typeof ownerId !== 'number' ||
+        !Number.isSafeInteger(ownerId) ||
+        ownerId <= 0 ||
+        typeof repositoryName !== 'string' ||
+        !/^[A-Za-z0-9_.-]+$/u.test(repositoryName) ||
+        typeof repositoryId !== 'number' ||
+        !Number.isSafeInteger(repositoryId) ||
+        repositoryId <= 0 ||
+        typeof fullName !== 'string' ||
+        fullName !== `${ownerLogin}/${repositoryName}`) {
+        return undefined;
+    }
+    const ownerIdString = String(ownerId);
+    const repositoryIdString = String(repositoryId);
+    return {
+        fullName,
+        ownerId: ownerIdString,
+        repositoryId: repositoryIdString,
+        subjectPrefix: `repo:${ownerLogin}@${ownerIdString}/${repositoryName}@${repositoryIdString}`,
+    };
+}
+function inspectOidcSubjectCustomization(value) {
+    const includeClaimKeys = value.include_claim_keys;
+    const useDefault = value.use_default;
+    const useImmutableSubject = value.use_immutable_subject;
+    if (typeof useDefault !== 'boolean' ||
+        (useImmutableSubject !== undefined &&
+            typeof useImmutableSubject !== 'boolean') ||
+        (includeClaimKeys !== undefined &&
+            (!Array.isArray(includeClaimKeys) ||
+                includeClaimKeys.some((key) => typeof key !== 'string')))) {
+        return undefined;
+    }
+    return {
+        includeClaimKeys: Array.isArray(includeClaimKeys)
+            ? [...new Set(includeClaimKeys)].sort(deterministic_order_js_1.compareUtf16)
+            : [],
+        useDefault,
+        useImmutableSubject: useImmutableSubject === true,
+    };
+}
 function asObjects(value) {
     return Array.isArray(value)
         ? value.filter((item) => typeof item === 'object' && item !== null && !Array.isArray(item))
@@ -498,9 +514,24 @@ async function inspectEnvironment(api, repositoryPath, name) {
         waitTimer: environmentWaitTimer(environment),
     };
 }
-async function inspect(api, repositoryPath, productionApprovalMode) {
+async function inspect(api, repositoryPath, productionApprovalMode, deploymentProfile) {
     const blockers = [];
     const repo = await api.request('GET', repositoryPath);
+    const repositoryIdentity = inspectRepositoryIdentity(repo);
+    if (!repositoryIdentity) {
+        blockers.push('GitHub repository identity must expose one canonical full name and positive immutable owner and repository IDs.');
+    }
+    let oidcSubjectCustomization;
+    try {
+        const oidcState = await api.request('GET', `${repositoryPath}/actions/oidc/customization/sub`);
+        oidcSubjectCustomization = inspectOidcSubjectCustomization(oidcState);
+        if (!oidcSubjectCustomization) {
+            blockers.push('GitHub repository OIDC subject customization returned an invalid response.');
+        }
+    }
+    catch (error) {
+        blockers.push(`GitHub repository OIDC subject customization could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
     let ownerPlanName;
     if (productionApprovalMode === 'environment-reviewer' &&
         requiresPrivateEnvironmentCapabilities(repo)) {
@@ -655,7 +686,7 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
             };
         }
     };
-    const environments = Object.fromEntries(await Promise.all(Object.keys(ENVIRONMENT_BRANCHES).map(async (name) => [name, await inspectNamedEnvironment(name)])));
+    const environments = Object.fromEntries(await Promise.all(githubEnvironmentTopology(deploymentProfile).map(async ({ name }) => [name, await inspectNamedEnvironment(name)])));
     return {
         blockers,
         state: {
@@ -664,10 +695,12 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
             environments,
             orgSecretNames,
             orgVariableNames,
+            oidcSubjectCustomization,
             ownerPlanName,
             ownedRuleset: rulesets.find((ruleset) => ruleset.name === exports.EBK_PROTECTED_BRANCH_RULESET_NAME &&
                 ruleset.source_type !== 'Organization'),
             repo,
+            repositoryIdentity,
             repositorySecretNames,
             repositoryVariableNames,
             rulesets,
@@ -694,6 +727,9 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
     if (state.repo.allow_rebase_merge !== false) {
         changes.push('Disable repository rebase merging.');
     }
+    if (requiresImmutableOidcSubjectCutover(state)) {
+        changes.push(GITHUB_IMMUTABLE_OIDC_CHANGE);
+    }
     if (state.actionsCanApprovePullRequests !== true) {
         blockers.push('GitHub Actions is not permitted to create or approve pull requests for managed sync-back.');
     }
@@ -722,17 +758,6 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
             blockers.push(`${variable} is exposed from organization variable scope instead of its protected environment.`);
         }
     }
-    for (const variable of [
-        ...exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES,
-        ...exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES,
-    ]) {
-        if (!state.repositoryVariableNames.includes(variable)) {
-            blockers.push(`Repository variable ${variable} is required for a protected read-only plan job; bootstrap never creates variable values.`);
-        }
-        if (state.orgVariableNames?.includes(variable)) {
-            blockers.push(`${variable} must be repository-bound instead of inherited from organization scope.`);
-        }
-    }
     for (const ruleset of state.rulesets) {
         const conflicts = conflictsWithMergeCommitContract(ruleset);
         if (conflicts.length > 0) {
@@ -746,7 +771,8 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
         JSON.stringify(normalizeRuleset(desiredRuleset()))) {
         changes.push(`Update ruleset ${exports.EBK_PROTECTED_BRANCH_RULESET_NAME}.`);
     }
-    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+    for (const topology of githubEnvironmentTopology(deploymentProfile)) {
+        const { branch, name: environment, stage } = topology;
         const current = state.environments[environment];
         if (!current.exists)
             changes.push(`Create ${environment} environment.`);
@@ -762,7 +788,7 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
         if (!current.branchPolicies.some(({ name, type }) => name === branch && type === 'branch')) {
             changes.push(`Restrict ${environment} deployment to ${branch}.`);
         }
-        const requiredSecrets = environmentSecretRequirements(environment, deploymentProfile);
+        const requiredSecrets = topology.requiredSecrets;
         for (const secret of requiredSecrets) {
             if (!current.secretNames.includes(secret)) {
                 blockers.push(`${environment} environment is missing ${secret}; bootstrap never creates secret values.`);
@@ -773,7 +799,7 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
                 blockers.push(`${environment} environment exposes ${secret} outside its exact capability boundary.`);
             }
         }
-        const requiredVariables = environmentVariableRequirements(environment, deploymentProfile);
+        const requiredVariables = topology.requiredVariables;
         for (const variable of requiredVariables) {
             if (!current.variableNames.includes(variable)) {
                 blockers.push(`${environment} environment is missing required variable ${variable}; bootstrap never creates variable values.`);
@@ -784,9 +810,8 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
                 blockers.push(`${environment} environment exposes ${variable} outside its exact capability boundary.`);
             }
         }
-        const stage = environmentStage(environment);
         if (environment !== stage) {
-            const desired = desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+            const desired = desiredEnvironmentProtection(topology, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
             if (environment === 'npm-prerelease' &&
                 productionApprovalMode === 'environment-reviewer' &&
                 desired.reviewers.length === 0) {
@@ -828,8 +853,9 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
             }
         }
     }
-    if (state.environments.staging.reviewers.length > 0) {
-        warnings.push('Staging has additional reviewer protection; bootstrap will preserve it.');
+    const rehearsalStage = deploymentProfile === 'starter' ? 'development' : 'staging';
+    if (state.environments[rehearsalStage].reviewers.length > 0) {
+        warnings.push(`${rehearsalStage === 'development' ? 'Development' : 'Staging'} has additional reviewer protection; bootstrap will preserve it.`);
     }
     return {
         blockers: [...new Set(blockers)].sort(),
@@ -837,6 +863,9 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
         deploymentProfile,
         ready: blockers.length === 0 && changes.length === 0,
         repository,
+        ...(state.repositoryIdentity
+            ? { repositoryIdentity: state.repositoryIdentity }
+            : {}),
         productionApprovalMode,
         warnings: [...new Set(warnings)].sort(),
     };
@@ -902,7 +931,10 @@ function rulesetMatchesDesired(ruleset) {
     return (JSON.stringify(normalizeRuleset(ruleset)) ===
         JSON.stringify(normalizeRuleset(desiredRuleset())));
 }
-async function applyChanges(api, repositoryPath, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds) {
+async function applyChanges(api, repositoryPath, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile) {
+    if (requiresImmutableOidcSubjectCutover(state)) {
+        await api.request('PUT', `${repositoryPath}/actions/oidc/customization/sub`, { use_default: true, use_immutable_subject: true });
+    }
     if (state.repo.allow_merge_commit !== true ||
         state.repo.allow_rebase_merge !== false ||
         state.repo.allow_squash_merge !== false) {
@@ -921,10 +953,10 @@ async function applyChanges(api, repositoryPath, state, productionApprovalMode,
     else if (!state.ownedRuleset) {
         await api.request('POST', `${repositoryPath}/rulesets`, desired);
     }
-    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+    for (const topology of githubEnvironmentTopology(deploymentProfile)) {
+        const { branch, name: environment, stage } = topology;
         const current = state.environments[environment];
-        const stage = environmentStage(environment);
-        const desiredProtection = desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+        const desiredProtection = desiredEnvironmentProtection(topology, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
         const reviewers = desiredProtection.reviewers;
         const desiredPreventSelfReview = desiredProtection.preventSelfReview;
         const desiredWaitTimer = desiredProtection.waitTimer;
@@ -990,15 +1022,25 @@ async function runGitHubBootstrap(options) {
     }
     const api = new GitHubApi(options.apiBaseUrl?.trim() || 'https://api.github.com', options.token);
     const repositoryPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
-    const initial = await inspect(api, repositoryPath, options.productionApprovalMode);
+    const initial = await inspect(api, repositoryPath, options.productionApprovalMode, deploymentProfile);
     const report = evaluate(repository, initial.state, initial.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile);
     if (!options.apply)
         return report;
     if (report.blockers.length > 0) {
         throw new Error(`GitHub bootstrap apply is blocked:\n- ${report.blockers.join('\n- ')}`);
     }
-    await applyChanges(api, repositoryPath, initial.state, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
-    const completed = await inspect(api, repositoryPath, options.productionApprovalMode);
+    if (requiresImmutableOidcSubjectCutover(initial.state)) {
+        const identity = initial.state.repositoryIdentity;
+        if (!identity) {
+            throw new Error('GitHub bootstrap cannot acknowledge immutable OIDC trust without the inspected repository identity.');
+        }
+        const expectedAcknowledgement = immutableOidcTrustAcknowledgement(identity);
+        if (options.immutableOidcTrustAcknowledgement !== expectedAcknowledgement) {
+            throw new Error(`GitHub bootstrap immutable OIDC subject cutover requires the exact AWS-trust readiness acknowledgement ${JSON.stringify(expectedAcknowledgement)}. Apply the matching immutable repository-subject AWS trusts, read them back, and rerun with --immutableOidcTrustAcknowledgement=${JSON.stringify(expectedAcknowledgement)}. No GitHub settings were changed.`);
+        }
+    }
+    await applyChanges(api, repositoryPath, initial.state, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile);
+    const completed = await inspect(api, repositoryPath, options.productionApprovalMode, deploymentProfile);
     return evaluate(repository, completed.state, completed.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile);
 }
 //# sourceMappingURL=github-bootstrap.js.map