Which permissions scope must be granted for a job that requests a GitHub Actions OIDC JWT for cloud federation?
Select an answer to reveal the explanation.
Short Explanation
Requesting the OIDC id token requires permissions.id-token: write on the workflow or job. contents or actions scopes do not substitute for minting the JWT.
Full Explanation
The OIDC token issuance path is gated by the id-token permission. Setting id-token: write allows the job to request a JWT from GitHub's OIDC provider for federation with external systems. contents: write affects repository content access via GITHUB_TOKEN, not OIDC minting. actions: read allows reading Actions artifacts and workflow metadata. security-events: write is used for code scanning SARIF upload. Many cloud configure-* actions fail with clear errors if id-token write is missing. Combine id-token: write with least-privilege contents: read when the job only needs to check out code and assume a cloud role through OIDC federation.