From f87bc50dc673f91a844b575fd7e19e9c5925d542 Mon Sep 17 00:00:00 2001 From: ethernet Date: Thu, 30 Jul 2026 21:32:44 -0400 Subject: [PATCH] fix(ci): grant id-token to the docker.yml reusable-workflow call MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docker.yml now requests id-token: write for WIF cache auth, but it is invoked as a reusable workflow from ci.yml on PRs — and a called workflow cannot request a permission its caller lacks. That mismatch is a startup_failure (run 30596417013 died before any job). Add id-token: write to ci.yml's top-level permissions. --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 15be11fd75a..3a328afbd8a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,6 +24,7 @@ permissions: pull-requests: write # needed by lint (PR comment) + supply-chain review_status actions: read # needed by osv-scanner (SARIF upload) security-events: write # needed by osv-scanner (SARIF upload) + id-token: write # needed by docker.yml (WIF -> Artifact Registry buildx cache) packages: write # needed by docker build concurrency: