add terraform plan job to CI using OIDC role

.github/workflows/ci.yml

@@ -37,3 +37,30 @@ jobs:
       - name: Build Docker image
         run: docker buildx build --platform linux/arm64 --provenance=false -t stockwatch .
 
+  terraform-plan:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::992550705663:role/stockwatch-github-actions-terraform
+          aws-region: us-east-1
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init
+        working-directory: infra
+        run: terraform init
+
+      - name: Terraform Plan
+        working-directory: infra
+        env:
+          TF_VAR_anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: terraform plan

infra/resources.tf

@@ -117,7 +117,8 @@ resource "aws_iam_role" "github_actions_terraform" {
             "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
           }
           StringLike = {
-            "token.actions.githubusercontent.com:sub" = "repo:medysaly/stockwatch:*"
+            "token.actions.githubusercontent.com:sub" = "repo:medysaly@187324769/stockwatch@1304130972:*"
+
           }
         }
       }