sdaf-gh-oidc-and-auth

name	sdaf-gh-oidc-and-auth
description	Action-loop skill for authenticating the SDAF GitHub Actions workflows to Azure. Two independent layers must both be right: (1) `azure/login` uses an OIDC federated credential and reads `AZURE_ENVIRONMENT` + `AZURE_AUDIENCE`; (2) Terraform and Ansible authenticate separately via either a managed identity (`USE_MSI=true`, `MSI_ID`) or a service principal with `ARM_CLIENT_SECRET`, and always read `ARM_ENVIRONMENT`. This skill resolves `AADSTS7002381` (enterprise-claim tenant policy), `AADSTS7000215` / `AADSTS700016` (missing or expired `ARM_CLIENT_SECRET`), `AADSTS900382` (sovereign-cloud `ARM_ENVIRONMENT` not exported alongside ARM creds), and "`azure/login` succeeded but hit the wrong cloud". Invoke on Azure-login failures, OIDC federated-credential questions, MSI-vs-SPN choice, or sovereign-cloud identity configuration. Do NOT invoke for bootstrap mechanics or the setup utility (use `sdaf-gh-bootstrap`) or for the workflow catalogue (use `sdaf-gh-workflow-sequence`).
allowed-tools	["Read","Grep"]
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0","class":"action-loop"}

sdaf-gh-oidc-and-auth

Diagnoses and configures the two independent authentication layers that every SDAF GitHub Actions workflow uses to reach Azure: azure/login (OIDC) and Terraform / Ansible (MSI or SPN + ARM_CLIENT_SECRET).