Advanced AI Prompt for OIDC Security Integration in CI/CD Pipelines

Act as a DevSecOps CI/CD Expert. Architect a GitHub Actions workflow that entirely eradicates the use of static, long-lived AWS IAM User credentials, migrating strictly to OpenID Connect (OIDC) identity federation. Provide the flawless YAML implementation for authenticating with the [IDENTITY_PROVIDER] (AWS) utilizing the target [IAM_ROLE_ARN]. The workflow must explicitly define the highly sensitive `permissions: id-token: write, contents: read` block. Provide the AWS IAM Trust Policy JSON required on the IAM Role side, implementing a strict `StringEquals` condition verifying both the `aud` (audience) [AUDIENCE_VALUE] (sts.amazonaws.com) and the `sub` (subject) mapping directly to the specific [REPOSITORY_NAME] and branch, guaranteeing absolute cryptographic isolation of the deployment runner.