A job requests a cloud OIDC token with actions/oidc or cloud login actions. Which permission must be granted?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Requesting the JWT from GitHub's OIDC provider requires permissions.id-token: write on the workflow or job.
Full explanation below image
Full Explanation
Without id-token: write, attempts to fetch the OIDC token fail. contents: write is for repo content mutation; actions: write relates to Actions artifacts/cache APIs at the token scope level; security-events: write is for code scanning uploads. Grant id-token: write only on jobs that federate to cloud, not globally if avoidable. Pair with cloud trust policies on sub claims. This replaces long-lived cloud access keys stored as secrets for many scenarios.