Github actions permissions - Help requested

[mattgu74]

Select Topic Area

Question

Body

Hello all,

This weekend, I enabled github enterprise trial but it kill all our github actions workflows, we cancel the trial to come back to the team subscription level and see if it's better, but that's not.

Actually all the workflows stopped because of permissions issues, like :

[Invalid workflow file: .github/workflows/ci.yml#L24](https://github.com/<redacted>/<redacted>/actions/runs/6931844739/workflow)
The workflow is not valid. .github/workflows/ci.yml (Line: 24, Col: 3): Error calling workflow '<redacted>/actions/.github/workflows/build-docker-image.yml@v2'. The nested job 'build-docker-image' is requesting 'id-token: write', but is only allowed 'id-token: none'.

I guess something that need to be optin on old organizations, has been automatically opt-in while changing subscriptions level.
Is there a way to opt-out for this settings ? Because we have so many workflows to fix because of that, that this is really depressing :/

Thanks a lot for your answers,
Matthieu

[mattgu74]

I finally found the settings by myself. In organization settings, there is a Workflow permissions option.

[hendricius]

That fixed it thanks. Just to everyone having the same issue. These are the settings in the current UI:

Open this menu in the repo settings (I don't have an org):

Then tick this option:

[xuhdev]

I think this is an unnecessarily broad elevation of permissions. The permission control can be narrowed to the specific workflow by elevating the permissions from the caller's side. See my comment below https://github.com/orgs/community/discussions/76409#discussioncomment-11260212

[TobiasUhmannVoss]

I have the same problem and could change the default permissions in the organization settings. But I don't want to. I want to have the restricted default permissions and make use of the YAML's job "permissions". And the "Workflow permissions" section in both the organization and repo settings states that "You can specify more granular permissions in the workflow using YAML.". Apparently, I can not. Furthermore, I checked the docs that "specifying more granular permissions" is not limited to further restricting permissions. According to the docs it should be possible to elevate permissions:

"You can modify the permissions for the GITHUB_TOKEN in individual workflow files. If the default permissions for the GITHUB_TOKEN are restrictive, you may have to elevate the permissions to allow some actions and commands to run successfully." [1]

Is there something different with organization default permissions? Are they an upper permission limit?

[1] https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

[TobiasUhmannVoss]

Okay, so I'm not sure if this is a bug, but I think it has something to do with me using nested workflows. This is my setup:

main workflow
main job 1 (calls sub workflow 1)
main job 2 (calls sub workflow 2)

sub workflow 2:
sub job 1
sub job 2 (needs permissions)

When requesting the permissions for "sub job 2" directly, I get the aforementioned error. When requesting them for the "main job 2", I do not. This is still not exactly what I want but much better than relaxing the organizational settings.

[xuhdev]

The safe way to do this is to elevate the permissions when calling the workflow:

jobs:
  call-workflow:
    permissions:
      id-token: write
  uses: org/workflows/.github/workflows/workflow.yml@<sha256>

See https://github.com/8hobbies/react-autonumeric/blob/bb7ac1f5f29138a80d5d00f2e51c32acb673ce29/.github/workflows/pages.yml#L25-L27 for a live example.