Add temporary OIDC claims debug workflow

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: umair-ably

.github/workflows/oidc-debug.yml

@@ -0,0 +1,36 @@
+name: OIDC Debug
+
+# Temporary diagnostic for the post-rename sts:AssumeRoleWithWebIdentity denial.
+# Prints the decoded OIDC claims (never the token itself) and attempts to assume
+# the new sdk-builds role with the current credentials action.
+
+on:
+  push:
+    branches: [debug/oidc-claims]
+
+permissions: {}
+
+jobs:
+  claims:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Print OIDC claims (claims only, no token material)
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const token = await core.getIDToken('sts.amazonaws.com');
+            const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString());
+            const { iss, sub, aud, repository, repository_owner, repository_id, ref, event_name } = payload;
+            console.log(JSON.stringify({ iss, sub, aud, repository, repository_owner, repository_id, ref, event_name }, null, 2));
+
+      - name: Assume new sdk-builds role (configure-aws-credentials v4)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: eu-west-2
+          role-to-assume: arn:aws:iam::${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK }}:role/ably-sdk-builds-ably-pubsub-ruby
+          role-session-name: oidc-debug
+
+      - name: Confirm assumed identity
+        run: aws sts get-caller-identity