ci: scope OIDC permissions to jobs#551

Open

zhongkechen wants to merge 1 commit into

mainfrom

codex/scope-workflow-oidc-permissions

zhongkechen commented Jul 17, 2026

Contributor

Summary

move id-token: write from workflow scope to the AWS-authenticating jobs
retain contents: read only where checkout requires it
keep workflow-level defaults read-only

Validation

git diff --check
parsed both edited workflow files as YAML
audited all workflow permission blocks to confirm OIDC grants are job-scoped

Fixes #170


          ci: scope OIDC permissions to jobs

60ea654

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet