chore: add id-token: write to new job-level permissions

Author: texastony

.github/workflows/ci_codegen.yml

@@ -13,6 +13,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_duvet.yml

@@ -14,6 +14,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_static_analysis.yml

@@ -12,6 +12,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_todos.yml

@@ -12,6 +12,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     runs-on: macos-14
     steps:
       - uses: actions/checkout@v6

.github/workflows/dafny-interop.yml

@@ -25,13 +25,15 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/mpl_head_version.yml
     with:
       mpl-head: ${{inputs.mpl-commit}}
   dafny-interop-java:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_java.yml
     with:
@@ -43,6 +45,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_test_vector_java.yml
     with:
@@ -54,6 +57,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_examples_java.yml
     with:
@@ -65,6 +69,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_test_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
@@ -74,6 +79,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_test_vector_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
@@ -83,6 +89,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_examples_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}

.github/workflows/dafny_verify_version.yml

@@ -15,6 +15,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVerifyVersion }}

.github/workflows/dafny_version.yml

@@ -15,6 +15,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVersion }}

.github/workflows/daily_ci.yml

@@ -16,19 +16,22 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     # Don't run the cron builds on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_version.yml
   getVerifyVersion:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_verify_version.yml
   daily-ci-format:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_format.yml
@@ -38,6 +41,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/ci_codegen.yml
@@ -47,6 +51,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVerifyVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_dafny_verification.yml
@@ -56,6 +61,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVerifyVersion
     uses: ./.github/workflows/test_vector_verification.yml
     with:
@@ -64,6 +70,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_java.yml
     with:
@@ -72,6 +79,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_java.yml
     with:
@@ -80,6 +88,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_java.yml
     with:
@@ -88,6 +97,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_net.yml
     with:
@@ -96,6 +106,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/library_rust_tests.yml
     with:
@@ -104,6 +115,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_net.yml
     with:
@@ -112,6 +124,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_net.yml
     with:
@@ -120,6 +133,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     needs:
       [
         getVersion,

.github/workflows/go-release.yml

@@ -17,6 +17,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_version.yml
 
   go-release:

.github/workflows/issue-notification.yml

@@ -10,6 +10,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     if: github.event_name == 'issues'
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
@@ -21,6 +22,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with: