diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 11:21:45 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-05-11 11:21:45 +0300 |
| commit | 89a90e1880e39b1a2ebf08d265f76dd16aa193f6 (patch) | |
| tree | 8e78f65189f502b8f77a807d4277ddfe0a0d28a0 /.github/workflows | |
| parent | c6f085d52fd44122e1f412b6d75ba9ad62a38dc9 (diff) | |
| parent | c4aaf3269c21f478a556d397599651dd099ad6db (diff) | |
| download | vyos-documentation-89a90e1880e39b1a2ebf08d265f76dd16aa193f6.tar.gz vyos-documentation-89a90e1880e39b1a2ebf08d265f76dd16aa193f6.zip | |
Merge pull request #1981 from vyos/yuriy/ai-validation-restore-id-token-rolling
ci(ai-validation): restore id-token: write (claude-code-action@v1 uses OIDC)
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/ai-validation.yml | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml index b21d2320..600e4e8b 100644 --- a/.github/workflows/ai-validation.yml +++ b/.github/workflows/ai-validation.yml @@ -204,6 +204,17 @@ jobs: # permissions split issue and PR scopes. pull-requests: write issues: write + # id-token: write is required by anthropics/claude-code-action@v1. + # The action calls actions/core's getIDToken() internally to mint + # an OIDC token used for the Claude/Anthropic auth federation + # path; without this scope it fails with + # `Could not fetch an OIDC token. Did you remember to add + # id-token: write to your workflow permissions?` + # An earlier Copilot finding suggested dropping this permission as + # "unused" — that was wrong: no shell step in this workflow + # invokes OIDC directly, but the third-party action does. Verified + # by run 25658256103 on PR #1977. + id-token: write steps: # Pass secrets via env: rather than inlining ${{ secrets.X }} into the # shell script. GitHub Actions template-expands ${{ ... }} BEFORE bash |