From 3755fd97bccfb16c9fcec2cc3e780fe13e738c70 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Thu, 23 Jul 2026 15:35:31 +0200 Subject: [PATCH] fix: grant id-token: write for claude-code-action OAuth flow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A manual AI fix sweep failed with "Could not fetch an OIDC token. Did you remember to add id-token: write to your workflow permissions?". The action mints a GitHub OIDC token to authenticate the claude_code_oauth_token flow, which needs id-token: write — absent from both jobs' permissions. Tier 2 failed on it now; tier 1 would have failed identically the first time it ran live. Added to both. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/daily_ai_fix.yaml | 1 + .github/workflows/on_issues_ai_triage.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/daily_ai_fix.yaml b/.github/workflows/daily_ai_fix.yaml index d16497c642..057cfa06d3 100644 --- a/.github/workflows/daily_ai_fix.yaml +++ b/.github/workflows/daily_ai_fix.yaml @@ -33,6 +33,7 @@ permissions: contents: write issues: write pull-requests: write + id-token: write # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow concurrency: group: ai-fix-sweep diff --git a/.github/workflows/on_issues_ai_triage.yaml b/.github/workflows/on_issues_ai_triage.yaml index 74bb18a5e3..0fe03bdf15 100644 --- a/.github/workflows/on_issues_ai_triage.yaml +++ b/.github/workflows/on_issues_ai_triage.yaml @@ -17,6 +17,7 @@ on: permissions: contents: read issues: write + id-token: write # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow concurrency: group: ai-triage-${{ github.event.issue.number }}