Fix: Re-instate id-token write for PyPI publish (#302)

Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
os-climate · Nov 20, 2024 · 992ee8f · 992ee8f
1 parent e346da2
commit 992ee8f
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/primary.yaml b/.github/workflows/primary.yaml
@@ -178,6 +178,8 @@ jobs:
       one_password_item: "op://hdiyadcjno2knqgvcy4wj5ulya/tm2ffuusrynfivtcsnamginhm4/password"
     permissions:
       contents: read
+      # Needed for trusted publishing
+      id-token: write
     secrets:
       OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.ONE_PASSWORD_PRODUCTION }}
       PYPI_CREDENTIAL: ${{ secrets.PYPI_DEVELOPMENT }}
@@ -199,6 +201,8 @@ jobs:
       one_password_item: "op://hdiyadcjno2knqgvcy4wj5ulya/vds5rebqxeqfrjqwpszxxicmzq/password"
     permissions:
       contents: read
+      # Needed for trusted publishing
+      id-token: write
     secrets:
       OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.ONE_PASSWORD_PRODUCTION }}
       PYPI_CREDENTIAL: ${{ secrets.PYPI_PRODUCTION }}