feat: support OIDC invalidate cloudfront

[jirimoravcik]

This PR adds OIDC support to invalidate cloudfront

[Copilot]

Pull request overview

Adds OIDC-based AWS role assumption support to the reusable “invalidate cloudfront distribution” workflow, enabling CloudFront invalidations without long-lived AWS access keys.

Changes:

• Introduces useOIDC and githubOIDCRoleArn inputs to enable OIDC-based auth.
• Makes AWS access key secrets optional and conditionally skips the static-credential assume-role step.
• Adds a two-step role assumption flow for OIDC (GitHub OIDC role → deployer role with chaining).

Comments suppressed due to low confidence (1)

.github/workflows/invalidate_cloudfront.yaml:75

• awsAccessKeyId/awsSecretAccessKey are now optional, but when inputs.useOIDC == false the workflow still attempts to use them and will fail with a non-obvious error if callers omit these secrets. Consider adding an early validation step that checks required inputs/secrets based on useOIDC and fails with a clear message (e.g., require access keys when useOIDC is false; require awsRoleArn/githubOIDCRoleArn when useOIDC is true).

      - name: assume IAM role
        if: inputs.useOIDC == false
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.awsAccessKeyId }}
          aws-secret-access-key: ${{ secrets.awsSecretAccessKey }}
          aws-region: ${{ inputs.awsRegion }}
          role-to-assume: ${{ inputs.awsRoleArn }}
          role-duration-seconds: ${{ inputs.awsSessionDuration }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.