Which workflow permission is required to request an OIDC JWT token from GitHub?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The id-token:write permission is the key that unlocks GitHub's OIDC token endpoint for your workflow.
Full explanation below image
Full Explanation
To use OIDC in a GitHub Actions workflow, the job must have 'permissions: id-token: write'. Without this permission, the GITHUB_ACTIONS_ID_TOKEN environment variable and the token request API are not accessible. This permission allows the job to request an OpenID Connect JWT token from GitHub's OIDC provider. Combined with 'contents: read' (usually needed to check out code), the minimal OIDC permission set is 'id-token: write' and 'contents: read'. This permission is NOT included in default GITHUB_TOKEN permissions.