[PoC] Inspect OIDC claims for an external fork PR

[fritznoff]

Before / After

Before: we do not have direct evidence showing which OIDC claims GitHub issues when this public repository runs a workflow from an external fork PR.

After: one fork-only diagnostic step requests an OIDC token and prints only selected non-secret claims. It never prints the JWT.

Why this approach

This is the smallest test that validates the GitHub side of the trust boundary without assuming an AWS role or accessing ECR. Using the production ECR role was rejected because a successful test would grant real private-image access.

Demo

After a maintainer approves the fork workflow if required, inspect the PoC — inspect fork OIDC claims step. The relevant expected values are:

sub: repo:PSPDFKit/helm-charts:pull_request
aud: sts.amazonaws.com
repository: PSPDFKit/helm-charts
event_name: pull_request

Out of scope

• Assuming any AWS role
• Reading or printing repository secrets
• Pulling or exposing the private Maestrod image
• Merging this diagnostic change

How to test

1. Approve this draft PR's workflow run if GitHub requires approval.
2. Open the Lint and Test Charts workflow.
3. Read only the output of PoC — inspect fork OIDC claims.
4. Confirm no AWS credential, ECR login, or image-pull step ran.

Manual QA steps

Confirm the log contains decoded claim fields but contains neither a three-part JWT nor AWS access credentials.

Risks / notes

This draft PR is a temporary security diagnostic and should be closed after evidence is captured. It changes no chart files, so existing AWS/ECR steps remain skipped.

[fritznoff]

This draft PR was created purely for authorized security testing of GitHub Actions OIDC permissions on external fork pull requests. No AWS role was assumed, no credentials or JWTs were printed, and no private image was accessed. The test is complete and the PR will not be merged.