ci: gate TA signing workflow against fork PRs

[NnnOooPppEee]

Summary

• Add an explicit same-repo guard to the ta job in default.yaml so fork PRs cannot reach the id-token: write signing job.
• Remove the Show OIDC claims (right before assume) debug step and the has AWS_ROLE secret? echo from the sign job in ta.yaml.

Why

HackerOne report #3718053 flags that the sign job holds id-token: write and compiles PR-controlled code (cargo x builds the checked-in x/ crate and any build.rs). It is not exploitable today because GitHub silently downgrades the fork GITHUB_TOKEN to read-only, so no OIDC token is issued on pull_request runs from forks. That protection is implicit and would break if the trigger changed to pull_request_target or the fork write-token setting were enabled. The gate makes the boundary explicit. The debug steps were trust-policy instrumentation that does not belong in a signing workflow.

Linear: ORBS-1702

Test plan

• Same-repo PR: ta job runs as before.
• Fork PR: ta job is skipped by the if guard.
• workflow_dispatch: unaffected.

[Copilot]

Pull request overview

This PR hardens the TA signing CI workflow by making the “same-repo only” boundary explicit for OIDC (id-token: write) usage, and by removing OIDC/AWS-secret diagnostic output from the signing workflow.

Changes:

• Add a job-level if guard in default.yaml to skip the ta reusable-workflow job for fork-based pull_request events.
• Remove OIDC-claims printing and AWS secret-presence echo steps from the sign job in ta.yaml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/ta.yaml	Removes OIDC/AWS debug steps from the signing job to reduce sensitive workflow instrumentation.
.github/workflows/default.yaml	Adds an explicit same-repo gate so fork PRs can’t invoke the OIDC-enabled TA signing workflow job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.