feat: AWS OIDC auth composite action (issue #27)

[ms280690]

Summary

• Adds aws-oidc-auth composite action wrapping aws-actions/configure-aws-credentials@v6.1.3 — no static credentials stored
• Enforces role-session-name: {repo}-{run_id} so every CloudTrail event is traceable to a specific run
• Adds docs/oidc-trust-policies.md with IAM trust policy templates, GitHub Environments setup, and migration checklist
• Adds aws-actions/configure-aws-credentials to approved-actions registry and aws-actions/* to org allowlist

Usage

jobs:
  deploy:
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: sparkgeo/github-actions/.github/actions/aws-oidc-auth@<SHA>
        with:
          role-arn: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ca-central-1

Notes

• Cannot be dogfooded in ci.yml — requires a real IAM role and trust policy in an AWS account
• GCP Workload Identity Federation is out of scope for this PR (AWS-only as agreed)
• Org-level work (auditing existing secrets, creating IAM roles, configuring environments) is tracked in issue feat: OIDC federation and secret management #27 checklist

Test plan

• Verify actionlint + zizmor pass (pre-commit hooks ran clean)
• Consuming repo: create IAM role with trust policy from docs/oidc-trust-policies.md, use action, verify aws sts get-caller-identity succeeds and CloudTrail shows {repo}-{run_id} session name
• Verify role-session-name override input works when trust policy requires fixed prefix

Closes #27 (composite action + docs deliverable; org-level secret migration is ongoing)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new aws-oidc-auth composite action that wraps aws-actions/configure-aws-credentials@v6.1.3 to perform short-lived AWS credential exchange via GitHub OIDC, eliminating the need for static AWS keys stored as secrets. Also adds supporting documentation and updates the approved-actions registry. Implements the AWS portion of issue #27 (Pillar 3: Modern Secret Management & Identity Federation); GCP WIF and org-level secret migration are explicitly out of scope.

Changes:

• New aws-oidc-auth composite action with pinned SHA, required role-arn/aws-region inputs, and an enforced {repo}-{run_id} session name (overridable).
• New docs/oidc-trust-policies.md covering trust policy templates, scope conditions, environment gating, and a migration checklist.
• Approved-actions registry and org allowlist updated to include aws-actions/configure-aws-credentials / aws-actions/*; README updated with action table entry and usage example.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/actions/aws-oidc-auth/action.yml	New composite action invoking configure-aws-credentials with traceable session name.
docs/oidc-trust-policies.md	New doc with trust-policy template, sub-claim scope table, env setup, and migration checklist.
docs/approved-actions.md	Registers aws-actions/configure-aws-credentials and adds aws-actions/* to the org allowlist.
README.md	Adds the action to the index and a usage example pointing to the new doc.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.