Which permissions scope must be granted for a job that requests a GitHub Actions OIDC JWT for cloud federation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Requesting the OIDC id token requires permissions.id-token: write on the workflow or job. contents or actions scopes do not substitute for minting the JWT.
Full explanation below image
Full Explanation
The OIDC token issuance path is gated by the id-token permission. Setting id-token: write allows the job to request a JWT from GitHub's OIDC provider for federation with external systems. contents: write affects repository content access via GITHUB_TOKEN, not OIDC minting. actions: read allows reading Actions artifacts and workflow metadata. security-events: write is used for code scanning SARIF upload. Many cloud configure-* actions fail with clear errors if id-token write is missing. Combine id-token: write with least-privilege contents: read when the job only needs to check out code and assume a cloud role through OIDC federation.