fix(ci): authenticate bedrock drift check via GitHub OIDC

[davehorton]

The check-bedrock-models workflow has failed on every scheduled run since it was added. The job passes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY from repo secrets, but this repo has no Actions secrets — they interpolate to empty strings and the SDK credential chain fails:

AWS_ACCESS_KEY_ID:
AWS_SECRET_ACCESS_KEY:
...
check-bedrock-models failed: CredentialsProviderError: Could not load credentials from any providers

The drift checker itself is fine — run locally against real credentials it completes cleanly (no drift, plus the usual not-found / novel-model lists).

Change

Since this repo is public, authenticate via GitHub OIDC rather than storing long-lived keys:

• add id-token: write to the job permissions
• assume a read-only role with aws-actions/configure-aws-credentials@v5, ARN from the repo variable BEDROCK_DRIFT_ROLE_ARN
• document the one-time AWS setup in the workflow header

Required before this works

1. Register GitHub as an IAM OIDC provider (https://token.actions.githubusercontent.com, audience sts.amazonaws.com).
2. Create a role trusted by it, conditioned on token.actions.githubusercontent.com:sub = repo:jambonz/llm:ref:refs/heads/main, with an inline policy granting only bedrock:ListFoundationModels and bedrock:ListInferenceProfiles.
3. Set the repo Actions variable BEDROCK_DRIFT_ROLE_ARN to that role ARN.

Verify with workflow_dispatch rather than waiting for the Monday cron.

🤖 Generated with Claude Code