From 60ea654abc7096e5b10093a503c35452ba1742c3 Mon Sep 17 00:00:00 2001
From: Frank Chen <frankchn@amazon.com>
Date: Fri, 17 Jul 2026 16:02:16 -0700
Subject: [PATCH] ci: scope OIDC permissions to jobs

---
 .github/workflows/cloud-tests.yml | 4 +++-
 .github/workflows/ecr-release.yml | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cloud-tests.yml b/.github/workflows/cloud-tests.yml
index 71118f77..4457cfe0 100644
--- a/.github/workflows/cloud-tests.yml
+++ b/.github/workflows/cloud-tests.yml
@@ -19,13 +19,15 @@ env:
   AWS_REGION: ${{ github.event.inputs.region || 'us-west-2' }}
 
 permissions:
-  id-token: write
   contents: read
 
 jobs:
   example-tests:
     name: example-tests (${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     concurrency:
       group: cloud-tests-${{ matrix.python-prefix }}
       cancel-in-progress: false
diff --git a/.github/workflows/ecr-release.yml b/.github/workflows/ecr-release.yml
index e2271ab6..239d521d 100644
--- a/.github/workflows/ecr-release.yml
+++ b/.github/workflows/ecr-release.yml
@@ -6,7 +6,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 env:
   package_path: packages/aws-durable-execution-sdk-python-testing
@@ -16,6 +15,9 @@ env:
 jobs:
   build-and-upload-image-to-ecr:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     outputs:
       full_image_arm64: ${{ steps.build-publish.outputs.full_image_arm64 }}
       full_image_x86_64: ${{ steps.build-publish.outputs.full_image_x86_64 }}
@@ -86,6 +88,8 @@ jobs:
 
   create-ecr-manifest-per-arch:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     needs: [build-and-upload-image-to-ecr]
     steps:
       - name: Configure AWS Credentials