cicd-security
Decode and validate GitHub Actions OIDC token claims against an expected-claims policy - a CI gate against trust-policy drift