From 0addd8e9cca8cac8f99c79495e74056772c64c9e Mon Sep 17 00:00:00 2001 From: Amrit Krishnan Date: Wed, 5 Aug 2026 10:13:21 -0400 Subject: [PATCH] fix(ci): add id-token permission to publish workflow for PyPI trusted publishing The v0.3.0 release failed to publish to PyPI: "Trusted publishing exchange failure: OpenID Connect token retrieval failed: GitHub: missing or insufficient OIDC token permissions, the ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable was unset." pypa/gh-action-pypi-publish attempts OIDC-based trusted publishing regardless of the password/token also being supplied, and that requires the job to explicitly request the id-token permission, which this workflow never had. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/publish.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a9f9e6499..cc9122385 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,6 +7,8 @@ on: jobs: deploy: runs-on: ubuntu-latest + permissions: + id-token: write steps: - name: Install apt dependencies run: |