Rename OIDC policy contract off the versioned name (kyle-sexton-github-iac-v2 → kyle-sexton-github-iac)

[melodic-ai]

Context

The pulumi-deploy-guard action's OIDC personal-token allow-policy contract is named kyle-sexton-github-iac-v2.json. Drop the -v2 suffix — versioned names are avoided by convention, and the version is now vestigial: v1 (standard-subject) is fully retired, the immutable-subject contract is the only one, and both github-iac repos are migrated to immutable subject. The action's SHA pin + git history already version the contract; the filename suffix is redundant.

Proposed name

kyle-sexton-github-iac (keyed by the Pulumi org + the governed program).

Scope (3 repos, SHA-coordinated)

melodic-software/ci-workflows (owns the contract + guard):

• git mv .github/actions/pulumi-deploy-guard/contracts/kyle-sexton-github-iac-v2.json .../kyle-sexton-github-iac.json
• .github/actions/pulumi-deploy-guard/guard.test.sh — 3 refs (lines 5, 74, 140)
• Merging yields the new guard-action SHA the consumers pin.

melodic-software/github-iac (consumer):

• .github/workflows/deploy.yml — policy-contract value (L70) + bump pulumi-deploy-guard@<SHA> (L68)
• tests/MelodicSoftware.GithubIac.Tests/GovernanceTopologyTests.cs — assertion (L1399)

kyle-sexton/github-iac (consumer):

• .github/workflows/deploy.yml — policy-contract value (L68) + bump pulumi-deploy-guard@<SHA> (L66)
• tests/KyleSexton.GithubIac.Tests/GovernanceFoundationTests.cs — assertion (L123)
• README.md — SHA-pinned contract link (L263)

Safe order (no breakage window)

1. Rename in ci-workflows + update guard.test.sh; merge. Consumers still pin the OLD SHA (old name), so both deploys keep working.
2. Per github-iac repo: bump the guard SHA to the new ci-workflows commit AND change policy-contract in the SAME PR (must move together), update the test + README; merge.
3. Verify: re-run both deploy.yml workflows → guard finds the renamed contract → green.

Acceptance

• No kyle-sexton-github-iac-v2 reference remains in any of the three repos.
• Both production deploys pass with the renamed contract.

Risk

SHA-coordinated security-wiring change. If a consumer's guard SHA and policy-contract value land out of sync, the deploy fails — OIDC auth 401 (wrong subjects) or guard "unknown policy contract". Follow the order above; verify each deploy after.

---

Filed as the clean alternative to a tail-end rename during the strict-status-checks / OIDC / #64 stabilization work. The functional stack is already clean; this is cosmetic naming only.

[kyle-sexton]

Resolved by the coordinated implementation: ci-workflows PR #96 renamed/reduced the contract, and github-iac PR #112 atomically adopted the new guard SHA and unversioned policy name. The former personal repository has been retired, surviving repositories contain no kyle-sexton-github-iac-v2 references, and production deploys have passed with the new contract. Closing as completed.