From 0ce37e597da3942e24e0cb72d97503adf2d97d97 Mon Sep 17 00:00:00 2001
From: Sythos <sythos@gmail.com>
Date: Tue, 25 Aug 2026 21:41:34 +0200
Subject: [PATCH] fix: grant PR attestation workflow permissions

---
 .github/workflows/pr-validation.yml | 2 ++
 README.md                           | 1 +
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 1438d54..6ada2e4 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -24,6 +24,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  attestations: write
 
 concurrency:
   group: pr-validation-${{ github.event.pull_request.number || github.ref }}
diff --git a/README.md b/README.md
index 1a6a928..90ddd8f 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,7 @@ of production capacity or external service interoperability.
 - [x] fast amd64-first CI with an explicit multiarch amd64+arm64 final gate;
 - [x] tenant-bound DAV ETags and sync tokens;
 - [x] OCI build-provenance attestations generated and verified;
+- [x] pull-request validation delegates the identity-token and attestation permissions required by the provenance gate;
 - [x] log rotation;
 - [x] alerts;
 - [x] Postfix queue visibility;