name: IAM functional tests (GitHub OIDC live)

# This workflow exercises AssumeRoleWithWebIdentity against a REAL external
# OIDC identity provider (GitHub Actions' own OIDC issuer) - the one publicly
# reachable, free IdP available from inside our own CI job, so no self-hosted
# IdP container is needed.
#
# Trigger stays plain `pull_request` (never pull_request_target or
# workflow_run) plus `push` to main. On a pull_request run, GitHub itself
# downgrades GITHUB_TOKEN/OIDC permissions to read-only whenever the PR
# comes from a fork - regardless of what this file requests - so
# ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN simply won't
# exist in that case and the test below skips itself. That's the actual
# security boundary here: a hostile fork-PR author cannot use their own PR
# to mint a token scoped to this repo's identity through this workflow. Only
# a same-repo (non-fork) pull_request run, or a push to main, gets real
# credentials and actually exercises the live OIDC flow.
permissions:
  contents: read
  id-token: write

on:
  pull_request:
  push:
    branches: [main]

jobs:
  build:
    name: RunIAMGitHubOIDCTest
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: "stable"
        id: go

      - name: Get Dependencies
        run: |
          go mod download

      - name: Build
        run: |
          make testbin

      - name: Run GitHub OIDC live web-identity and s3 session tests
        run: |
          ./runoidctests.sh