From 39988c652685172db369167c82a51f82388d1e0a Mon Sep 17 00:00:00 2001 From: Andrew Rich Date: Mon, 9 Mar 2026 09:58:32 -0700 Subject: [PATCH] fix(claude-assistant): add id-token: write to reusable workflow permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reusable workflow's permissions block overrides the caller's permissions. id-token: write must be present in the reusable workflow itself (not just the caller) for claude-code-action to fetch an OIDC token. Previously this was omitted while trying to avoid startup_failure from actions: read. id-token: write does not cause startup_failure — it is a standard permission supported in reusable workflows. --- .github/workflows/claude-assistant.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/claude-assistant.yml b/.github/workflows/claude-assistant.yml index b1052a3..20499bc 100644 --- a/.github/workflows/claude-assistant.yml +++ b/.github/workflows/claude-assistant.yml @@ -36,6 +36,7 @@ jobs: contents: read pull-requests: read issues: read + id-token: write # required by claude-code-action for internal authentication steps: - name: Checkout repository uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4