ci: scope OIDC permissions to jobs#551

Merged

zhongkechen merged 1 commit into

mainfrom

codex/scope-workflow-oidc-permissions

Jul 20, 2026

zhongkechen commented Jul 17, 2026

Contributor

Summary

move id-token: write from workflow scope to the AWS-authenticating jobs
retain contents: read only where checkout requires it
keep workflow-level defaults read-only

Validation

git diff --check
parsed both edited workflow files as YAML
audited all workflow permission blocks to confirm OIDC grants are job-scoped

Fixes #170


          ci: scope OIDC permissions to jobs

60ea654

zhongkechen self-assigned this

ayushiahjolia approved these changes

View reviewed changes

zhongkechen merged commit 7d819fa into main

13 checks passed

zhongkechen deleted the codex/scope-workflow-oidc-permissions branch

July 20, 2026 16:46

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet