OIDC fails for pull request from forks

[omus]

Issue was noticed in #633 as this error when assuming the CI AWS role:

Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

The issue is that we require id-token: write for OIDC auth but forks are restricted to read. There exists an option to address this for private repos but not for public repos.

Other somewhat useful links found while looking into this:

• OIDC fails for pull request from fork aws-actions/configure-aws-credentials#373
• Document id-token permission github/docs#14626
• Someone running into the same issue
• "Could not load credentials from any providers" issue from aws-actions/configure-aws-credentials
• Events that trigger workflows in forked repositories

Introduced in #627

[omus]

I only noticed this issue after we stopped using bors so it's possible that bors didn't have this problem with OIDC. We're still using bors on AWSS3.jl with OIDC so we can verify this once a non-member creates a PR there.

[iamed2]

A possible alternative: https://github.com/imjohnbo/ok-to-test