From 0889d0f4e4d28dfee159dfcc67fbd9c4dbbfc43e Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Wed, 6 May 2026 19:44:35 -0400
Subject: [PATCH] Add id-token: write permission for claude-code-action

The action requires OIDC token access even when using an API key directly.
Also updates the rollout script template for future repos.
---
 .github/workflows/claude-code-review.yaml | 1 +
 scripts/rollout-review-workflow.sh        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml
index 346b849..12b02ea 100644
--- a/.github/workflows/claude-code-review.yaml
+++ b/.github/workflows/claude-code-review.yaml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write
 
 jobs:
   claude-review:
diff --git a/scripts/rollout-review-workflow.sh b/scripts/rollout-review-workflow.sh
index e71c85a..19d0fb4 100755
--- a/scripts/rollout-review-workflow.sh
+++ b/scripts/rollout-review-workflow.sh
@@ -15,6 +15,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write
 
 jobs:
   review: