ci: temporary WIF smoke test (to be deleted)

Author: mdheller

.github/workflows/wif-smoke.yml

@@ -0,0 +1,24 @@
+name: wif-smoke
+on: push
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+          token_format: access_token
+      - name: prove OIDC->sourceos-ci impersonation + GAR read (write role implies read)
+        run: |
+          T="${{ steps.auth.outputs.access_token }}"
+          test -n "$T" && echo "token minted: OK"
+          echo "identity:"; curl -s "https://oauth2.googleapis.com/tokeninfo?access_token=$T" | tr ',' '\n' | grep -iE '"email"|"issued_to"' || true
+          code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $T" \
+            "https://artifactregistry.googleapis.com/v1/projects/socioprophet-platform/locations/us-central1/repositories/socioprophet")
+          echo "GAR repo GET http=$code"; test "$code" = "200"