# Official source map

Reviewed during authoring on 10 November 2026. A source confirms a platform behavior; it does not confirm that this workshop's live run passed. Current live/local status is recorded separately in [validation.md](validation.md).

| Topic | Primary reference | Workshop use |
|---|---|---|
| GitHub OIDC claims | [OpenID Connect reference](https://docs.github.com/en/actions/reference/security/oidc) | Observe exact issued issuer/subject/audience and repository/ref claims; do not assume an older subject format |
| OIDC with Azure | [GitHub Azure OIDC guide](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-azure) | Token permission and Azure trust are separate from Azure RBAC |
| Azure user-assigned identity federation | [Connect GitHub to Azure with OIDC](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect) | Exact trust on two owned UAMIs; no client secret in pipeline login |
| FIC propagation/cache delay | [Microsoft Entra FIC considerations](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-considerations#time-for-federated-credential-changes-to-propagate) | Bounded fresh retries after change; continued success is not an accepted subject-rejection result |
| AzureRM backend | [Terraform AzureRM backend](https://developer.hashicorp.com/terraform/language/backend/azurerm) | Entra authentication, exact container scope and Blob-native locking |
| Saved plans | [Terraform plan](https://developer.hashicorp.com/terraform/cli/commands/plan) | Review `-out` artifact and apply that original binary |
| Sensitive JSON | [Terraform show](https://developer.hashicorp.com/terraform/cli/commands/show) | Full plan/state JSON stays private because sensitive values can appear in plaintext |
| Lock ownership | [Terraform state locking](https://developer.hashicorp.com/terraform/language/state/locking) | Fail safely on contention; never unlock an unknown owner's lock |
| Pinned Azure lock precheck | [Terraform 1.15.8 Azure backend source](https://raw.githubusercontent.com/hashicorp/terraform/v1.15.8/internal/backend/remote-state/azure/client.go) | Locked blob-property check precedes AcquireLease; a local lock rejection need not produce HTTP 409 |
| Artifact access/retention | [Download workflow artifacts](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/download-workflow-artifacts) | Private artifact access is sensitive; one-day retention differs from 15-minute operational approval |
| Runner hosting boundary | [Self-hosted runner concepts](https://docs.github.com/en/actions/concepts/runners/self-hosted-runners) | User manages the host; one-job registration is not a reimaged VM |
| Workflow security | [Secure use reference](https://docs.github.com/en/actions/reference/security/secure-use) | Main-only reviewed dispatch; no untrusted PR execution on this host |
| Resource-specific Blob logs | [StorageBlobLogs](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/storagebloblogs) | Documented query projections and actual request correlation |

## Workshop-specific choices

The two-group architecture, exact private CIDRs, deployment/control role split, 15-minute approval lifetime, one-day artifact retention, review tuple, canary, finite-lease exercise, €20 operational limit and screenshot contract are workshop design decisions. They are not Azure defaults or guarantees supplied by the references.

The article explains the remaining race: fresh comparison and backend locking do not atomically freeze external Azure Resource Manager writers. This lab's explicit manual approval also does not claim protected-environment or independent reviewer enforcement.