Skip to content

ci(release): add the 'id-token' permissions #948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JohnVillalovos merged 1 commit into from
Feb 4, 2026
Merged

ci(release): add the 'id-token' permissions #948

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ jobs:

permissions:
contents: write
id-token: write
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The id-token: write permission is typically used for PyPI trusted publishing with OIDC tokens, Sigstore signing, or authentication with cloud providers. Based on the workflow steps, none of these features appear to be in use:

  • This is a PHP project (composer.json), not a Python package
  • The workflow only creates GitHub releases and uploads assets
  • No PyPI publishing, Sigstore signing, or cloud authentication is configured

Adding this permission increases the attack surface without apparent benefit. Could you clarify which specific step in this workflow requires the id-token permission? If it's not actively being used, consider removing it to follow the principle of least privilege.

If the documentation recommends this for future features or specific configurations, please verify that those features are actually enabled in your releaserc.toml configuration.

Suggested change
id-token: write

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The release-dry-run.yml workflow (which uses the same python-semantic-release action) does not include the id-token: write permission. For consistency and to maintain the principle of least privilege, both workflows should have the same permissions unless there's a specific reason for the difference. If id-token is needed for release.yml, consider whether it's also needed for release-dry-run.yml, or vice versa.

Copilot uses AI. Check for mistakes.

steps:
- uses: actions/checkout@v6.0.1
Expand Down