Example
permissions:
contents: read
id-token: write
pre-steps:
- name: Fetch token via OIDC
id: fetch-token
uses: org/fetch-token@v1
jobs:
safe_outputs:
permissions:
id-token: write
contents: read
issues: write
conclusion:
permissions:
id-token: write
contents: read
issues: writeResult after gh aw compile
agent keeps id-token: write.
safe_outputs / conclusion lock permissions are only:
permissions:
contents: read
issues: write
Those jobs then fail OIDC mint: Missing id-token permission.
Expected
Compiled safe_outputs and conclusion retain id-token: write as declared under jobs.*.permissions.
Example
Result after
gh aw compileagentkeepsid-token: write.safe_outputs/conclusionlock permissions are only:Those jobs then fail OIDC mint: Missing id-token permission.
Expected
Compiled
safe_outputsandconclusionretainid-token: writeas declared underjobs.*.permissions.