test(ci): guard telemetry OIDC permission drift

[dinakarjs]

Later workflow edits can silently expand OIDC authority beyond the existing release and Scorecard jobs. This adds tools/check_workflow_oidc.py, runs it in the existing Python CI matrix, and proposes preserving exactly release.yml/publish-pypi, release.yml/publish-npm, release.yml/release-assets and scorecard.yml/analysis for maintainer review.

The guard inventories all 10 .yml/.yaml workflows. It rejects workflow-wide grants even when jobs shadow them, write-all at either scope (including allowed publishers), added/removed/renamed grants, malformed permission/workflow shapes and an empty inventory. Read-only inheritance remains valid. Existing publishing, attestation and Scorecard grants are unchanged; preserving a grant is not a determination that it is necessary. Release documentation and changelog record the bounded source-only contract.

PyYAML 6.0.3 is an explicit test-only dependency. The universal hash lock was regenerated while preserving every existing locked package/version; the only new lock entry is PyYAML. The guard is mandatory in CI rather than skipped when the parser is absent. No runtime dependencies or SDK/wire semantics change.

Validation from fresh hash-locked environments, with this checkout installed:

• Python 3.10.22: 133 unittest tests, OK (3 expected skips).
• Python 3.12.14: 158 unittest tests, OK.
• Seven new unittest methods include 15 copied-real-workflow drift scenarios, malformed/empty inventories, read-only controls and a direct python -O CLI positive/refusal pair.
• Three isolated checker bypasses are detected: allowance comparison disabled (9 failures), default-grant check disabled (3), allowed-publisher write-all check disabled (1). Temporary copies only.
• Ruff E4/E7/E9/F on new Python files and git diff --check pass. Published tree a243a48009d5e86fd8a9804283c8a922148001ef equals the tested local tree.

The first full local runs inherited an external OTEL_TRACES_SAMPLER=parentbased_traceidratio configuration, producing non-recording spans in existing exporter/propagation tests. Setting OTEL_TRACES_SAMPLER=always_on for the test processes made both complete suites pass without changing repository code. The focused guard tests passed before that adjustment too.

Hosted Python 3.11/3.13, TypeScript/artifact checks, CodeQL and actionlint remain required; no package publishing or live workflow dispatch performed. This continues agentrust-io/.github#54 after proposed WCM #210 and integrations #339 source guards. It does not verify live environment approvals, administrator bypass, deployment refs, trusted-publisher bindings or primary/backup operators, and does not close the parent tracker.

Literature and contribution boundary

• GitHub Actions workflow syntax: permissions: defines workflow/job token permissions. The guard checks repository source against its reviewed allowance inventory.
• SLSA v1.2, Verifying artifacts: artifact verification depends on trusted builder expectations. A source permission inventory supplies only part of that assurance; live identity bindings and administrator controls need separate evidence.

These references explain the source-only scope. This merged change does not establish live environment protection, trusted-publisher configuration or backup-operator coverage, and does not close organization issue #54.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[noah-ing]

Reviewed exact head c98d9fdfd0d7f88b49fb45c23ecd69b43ba4e9d1 as a source-only workflow OIDC permission baseline. The 10-workflow inventory preserves the four existing named grants. The focused suite passes 7/7; an independent mutation sweep rejected 54 grant additions/broadenings/removals and accepted 11 benign read-only edits. Python 3.10–3.13, TypeScript, actionlint, CodeQL, and changed-code fuzz checks are green. The single commit carries a DCO sign-off. I found no blocker in this bounded change. Live publishing environments and external trust bindings remain outside this source review.

[dinakarjs]

@rajnisht7 routing this bounded source-only change to the recorded primary maintainer. Noah has independently approved exact head c98d9fdfd0d7f88b49fb45c23ecd69b43ba4e9d1; current-head technical checks passed. Please assess maintainer acceptance/merge when available. The connector returned HTTP 403 for a formal reviewer request, so I am recording the handoff here instead. Live environment protections, registry trust bindings and operator coverage remain separate open work in agentrust-io/.github#54; this is not a request to bypass the maintainer gate or publish a package.