OIDC fails for pull request from fork

[martinschaef]

I have a pull request from a fork:
aws-samples/amazon-codeguru-samples#10
both the fork and the original repo are allow-listed in my role:

    - name: Assume IAM Role
      continue-on-error: true
      uses: aws-actions/configure-aws-credentials@v1
      id: iam-role
      with:
        role-to-assume: arn:aws:iam::048169001733:role/GuruGitHubCICDRole
        aws-region: us-west-2

when I trigger only on pull_request, the action fails to get credentials:
https://github.com/aws-samples/amazon-codeguru-samples/runs/5030685457?check_suite_focus=true

However, when I trigger on push it works:
https://github.com/martinschaef/amazon-codeguru-samples/runs/5030736213?check_suite_focus=true

Any idea how to fix that? This makes it hard to use pull-request triggers with code guru

[martinschaef]

I did a diff on the Env of the container between a successful run where I do the diff within the same repo (here) and a failed run where I did the pull request between forks (here), and what stands out is that the successful one has this environment variable set:

ACTIONS_ID_TOKEN_REQUEST_URL=https://pipelines.actions.githubusercontent.com/8gSNdP7bngsu7R8ZtlyKycT9Z5JyrhA4xZ3yEWzgklfyiLdEHy/00000000-0000-0000-0000-000000000000/_apis/distributedtask/hubs/Actions/plans/f109fc7a-1b6c-4897-8b4b-56a92ebe0544/jobs/c6e63bc3-5e65-523d-429d-d69eea406c8a/idtoken?api-version=2.0

but the failed attempt does not set it.

[martinschaef]

Oh ... so it looks like you need the id-token: write permission to set this variable and the maximum level for that permission across forks is read according to the GitHub documentation:
https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
So you basically can't use this way of authenticating for Pull Requests.

[martinschaef]

Would it be possible to fail with a different error message?

[cm-rwakatsuki]

For your reference
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks

[martinschaef]

Thanks! This is super useful!