Add missing permissions block to claude.yml workflow

[timothylee58]

Summary

Every run of the Claude Code GitHub Actions workflow (.github/workflows/claude.yml) has been failing with:

Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions?

(confirmed via job logs on multiple recent runs, e.g. run 30807193637)

GitHub Actions jobs default to read-only permissions unless a permissions: block explicitly grants more. This workflow never declared one, so anthropics/claude-code-action@main's OIDC token request — needed to mint a short-lived GitHub token for posting PR/issue comments — had nothing to work with and failed on every retry.

Fix

Added the permissions block the action's docs specify: contents: write, pull-requests: write, issues: write, and id-token: write.

Note — separate issue also observed in the logs

The same failed run's logs also show ANTHROPIC_API_KEY: (empty) — the ANTHROPIC_API_KEY repository secret isn't set. This permissions fix alone won't make the workflow succeed; the secret still needs to be added via Settings → Secrets and variables → Actions → New repository secret on GitHub (not something I can set from here). Flagging so it's not missed as a second blocker.

Test plan

• After merge + adding the ANTHROPIC_API_KEY secret, confirm the next PR comment triggers a successful claude job run

---

Generated by Claude Code

---

Note

Low Risk
CI-only workflow configuration with no application or data-path changes; scope is limited to granting the Claude action the permissions its docs require.

Overview
The Claude Code workflow (.github/workflows/claude.yml) was failing because the job had no explicit permissions, so GitHub kept the default read-only scope and anthropics/claude-code-action could not obtain an OIDC token for posting comments.

This change adds a permissions block on the claude job with contents: write, pull-requests: write, issues: write, and id-token: write, matching what the action needs for comment posting and OIDC.

^{Reviewed by Cursor Bugbot for commit 52b5f61. Configure here.}

---

Summary by cubic

Add the missing permissions block to .github/workflows/claude.yml so anthropics/claude-code-action@main can fetch an OIDC token and post PR/issue comments. Fixes the recurring “Could not fetch an OIDC token” failures.

• Bug Fixes

  • Added permissions to the claude job: id-token: write, contents: write, pull-requests: write, issues: write.

• Migration

  • Add the ANTHROPIC_API_KEY repository secret (Settings → Secrets and variables → Actions).

^{Written for commit 52b5f61. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 91d8cee0-bbf5-466d-adbc-87a70d99206f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_38995c54-641d-410e-8cdb-503fef4121c2)

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.