fix(ci): fix check-docs workflow OIDC token failure

[aboucaud]

Summary

• Adds missing id-token: write permission to the check-docs job — claude-code-action requires an OIDC token to authenticate, which was causing intermittent CI failures with "Could not fetch an OIDC token. Did you remember to add id-token: write to your workflow permissions?"

Test plan

• Merge a PR and verify the check-docs workflow completes without the OIDC token error

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	lightcone-cli	1e32110	Commit Preview URL Branch Preview URL	May 08 2026, 08:43 AM

[github-actions]

✅ Eval Results

Metric	Value
Score	1.00
Build complete	✅
Cost	$1.02
Turns	40
Duration	395s
lightcone-cli	0.3.5.dev9+g7365274a8 (7365274a)
Results	Download

Graders

✅ spec_valid (1.00)
✅ all_materialized (1.00)

Full output

08:42:50 lightcone.eval.build Building lightcone-cli wheel from /home/runner/work/lightcone-cli/lightcone-cli ...
08:42:55 lightcone.eval.build Built lightcone_cli-0.3.5.dev9+g7365274a8-py3-none-any.whl (commit 7365274a)
08:42:58 lightcone.eval.sandbox Created sandbox 2643a6e5-08ff-4c84-8135-a93d4fcbe69a for trial build-snae-0
08:42:59 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/2643a6e5-08ff-4c84-8135-a93d4fcbe69a/files/bulk-upload "HTTP/1.1 200 OK"
08:43:00 lightcone.eval.sandbox Installed wheels: ['lightcone_cli-0.3.5.dev9+g7365274a8-py3-none-any.whl']
08:43:01 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/2643a6e5-08ff-4c84-8135-a93d4fcbe69a/files/bulk-upload "HTTP/1.1 200 OK"
08:43:01 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/2643a6e5-08ff-4c84-8135-a93d4fcbe69a/files/bulk-upload "HTTP/1.1 200 OK"
08:43:01 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/2643a6e5-08ff-4c84-8135-a93d4fcbe69a/files/bulk-upload "HTTP/1.1 200 OK"
08:43:02 httpx HTTP Request: POST https://proxy.app.daytona.io/toolbox/2643a6e5-08ff-4c84-8135-a93d4fcbe69a/files/bulk-upload "HTTP/1.1 200 OK"
08:49:38 lightcone.eval.sandbox Deleted sandbox for trial build-snae-0
  snae trial 0: score=1.00 complete

lightcone-cli: 0.3.5.dev9+g7365274a8 (HEAD 7365274a)
ASTRA: 0.2.7

  Eval Results: Scores  
┏━━━━━━┳━━━━━━━━━━━━━━━┓
┃ Task ┃     Score     ┃
┡━━━━━━╇━━━━━━━━━━━━━━━┩
│ snae │ 1.00 +/- 0.00 │
│      │ pass@k: 100%  │
└──────┴───────────────┘

   Eval Results: Cost &   
         Duration         
┏━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Task ┃ Cost / Duration ┃
┡━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ snae │      $1.02      │
│      │      395s       │
└──────┴─────────────────┘

Total: 1 trials, $1.02, 395s

Results saved to: eval-results/build-7365274a/results.json