From 7a490bc3b01760505e6a6847c851f6cc274e9097 Mon Sep 17 00:00:00 2001 From: Thomas Cederholm Date: Mon, 10 Aug 2026 17:04:21 +0200 Subject: [PATCH] ci: Add id-token permissions to support WIF Grant workflow-level `id-token: write` in release.yaml and pull_request.yaml so the jobs calling extenda/actions/* can request an OIDC token from GitHub. The release job already re-declared it alongside `contents: write`; job-level blocks replace rather than merge, so that one stays as-is. The extenda wrappers pick their auth mode from the contents of the service-account-key value -- either a legacy `private_key` JSON key or a `workload_identity_provider` federation config. SECRET_AUTH currently holds a legacy key, so this permission is groundwork only. The migration completes when SECRET_AUTH is swapped to a WIF cred-config on the GCP side, which also needs the WIF principal to hold the Secret Manager roles the current service account has. The commonpom 4.0.3+ prerequisite does not apply here: this repo has no io.extenda.maven:commonpom parent since #86, and the Maven deploy authenticates to Maven Central with the MAVEN_CENTRAL_* and GPG secrets rather than to GCP. --- .github/workflows/pull_request.yaml | 4 ++++ .github/workflows/release.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml index 1ff2619..c86e81c 100644 --- a/.github/workflows/pull_request.yaml +++ b/.github/workflows/pull_request.yaml @@ -4,6 +4,10 @@ on: branches: [ master ] types: [ opened, synchronize, reopened ] +permissions: + contents: read + id-token: write + env: MAVEN_INIT: 'false' diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 634a110..4187428 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -4,6 +4,10 @@ on: push: branches: [ master ] +permissions: + contents: read + id-token: write + env: MAVEN_INIT: 'false'