From 369139bd38f147aa10b9f8b4f689981b0eb1d70c Mon Sep 17 00:00:00 2001
From: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>
Date: Fri, 7 Aug 2026 23:44:39 +0200
Subject: [PATCH] fix(ci): grant id-token permissions to deploy-all.yml caller
 jobs

deploy-all.yml invokes four reusable deploy workflows via `uses:` without
declaring any `permissions:` block on the calling jobs. A reusable
workflow's own permissions can never exceed what its caller grants, and
`id-token` is never part of the default GITHUB_TOKEN scope, so each
callee's `configure-aws-credentials` / `google-github-actions/auth` /
`azure/login` step failed to obtain an OIDC token when run through this
multi-cloud path.

Add `permissions: {id-token: write, contents: read}` at job level to the
four caller jobs (deploy-aws-lambda, deploy-aws-fargate, deploy-gcp,
deploy-azure), matching what each callee workflow's own deploy job
requires. determine-deployment and notify are left untouched since
neither authenticates and neither should receive id-token.

Closes #1665
Closes #1587
---
 .github/workflows/deploy-all.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/deploy-all.yml b/.github/workflows/deploy-all.yml
index bdf93d0ae..81b1ee9c7 100644
--- a/.github/workflows/deploy-all.yml
+++ b/.github/workflows/deploy-all.yml
@@ -119,6 +119,9 @@ jobs:
     name: Deploy AWS Lambda
     needs: determine-deployment
     if: needs.determine-deployment.outputs.deploy-aws-lambda == 'true'
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/deploy-aws-lambda.yml
     with:
       environment: ${{ needs.determine-deployment.outputs.environment }}
@@ -133,6 +136,9 @@ jobs:
     name: Deploy AWS Fargate
     needs: determine-deployment
     if: needs.determine-deployment.outputs.deploy-aws-fargate == 'true'
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/deploy-aws-fargate.yml
     with:
       environment: ${{ needs.determine-deployment.outputs.environment }}
@@ -145,6 +151,9 @@ jobs:
     name: Deploy GCP Cloud Run
     needs: determine-deployment
     if: needs.determine-deployment.outputs.deploy-gcp == 'true'
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/deploy-gcp.yml
     with:
       environment: ${{ needs.determine-deployment.outputs.environment }}
@@ -157,6 +166,9 @@ jobs:
     name: Deploy Azure Container Apps
     needs: determine-deployment
     if: needs.determine-deployment.outputs.deploy-azure == 'true'
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/deploy-azure.yml
     with:
       environment: ${{ needs.determine-deployment.outputs.environment }}