[mheffner]

Problem

CI fails for pull requests opened from forks (e.g. PR #97 — see the failed run). The Configure AWS credentials step errors with:

Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

GitHub does not expose repo secrets or an OIDC token to pull_request runs from forks, so secrets.AWS_LAMBDA_CI_ROLE_ARN is empty and the role assumption fails before tests ever run. The workflow already skipped these steps for dependabot (which has the same limitation), but not for fork PRs.

Fix

Extend the existing if: condition on the Configure AWS credentials and Set secret test ARNS steps to also skip when the PR's head repo is a fork:

if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.fork != true }}

• On push events github.event.pull_request is null, so the expression evaluates to null != true → true, and the steps run as before.
• Same-repo PRs have fork == false, so the steps also run as before.
• Fork PRs and dependabot runs skip both steps entirely. Skipping the Set secret test ARNS step (rather than writing empty values) matters because the test gate is std::env::var(...).is_ok() — an empty-but-set TEST_* variable would pass the gate and the tests would then fail.

No pull_request_target is used; fork PRs simply run without any AWS credentials or AWS-related env vars.

Why the tests tolerate this

All AWS-dependent tests already gate on their env var being set and return early otherwise:

• secrets::secretsmanager::tests::test_basic_secret_retrieval → TEST_SECRETSMANAGER_ARNS
• secrets::paramstore::tests::test_basic_paramstore_retrieval → TEST_PARAMSTORE_ARNS
• env::tests::test_resolve_multiple_secrets → TEST_ENVSECRET_ARNS
• env::tests::test_resolve_secrets_with_failures → TEST_ENVSECRET_FAIL_ARNS (never set in CI)

These are the only tests that touch AWS clients (AwsClient::new / AwsCreds::from_env), so no code changes were needed.

Verification

Ran cargo nextest run locally with no AWS credentials and all TEST_* vars unset:

Summary [   0.021s] 26 tests run: 26 passed, 0 skipped

Re-running the four AWS-dependent tests with --no-capture confirms each takes the skip path:

Skipping test_resolve_multiple_secrets due to unset envvar
Skipping test_resolve_secrets_with_failures due to unset envvar
Skipping test_basic_paramstore_retrieval due to unset envvar
Skipping test_basic_secret_retrieval due to unset envvar