Flaky CI Failure: release-notes update-release-notes — OIDC token missing id-token:write permission

[github-actions]

Flaky CI Failure: release-notes update-release-notes — OIDC token missing id-token:write permission

Workflow: Create Release Branch
Failed run: https://github.com/xmtp/libxmtp/actions/runs/30372377812
Commit: 07a2d55
Failed jobs: release-notes / update-release-notes

Summary

The release-notes / update-release-notes job fails immediately because the anthropics/claude-code-action/v1 action cannot obtain an OIDC token. The action retries 3 times then exits with code 1. The root cause is that .github/workflows/release-notes.yml only grants contents: write and pull-requests: write permissions — it is missing id-token: write, which the Claude Code action requires to authenticate via OIDC.

Error Details

Requesting OIDC token...
Attempt 1 of 3...
Retrying in 5 seconds...
Failed to get OIDC token: ...
error: Error message: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
      at getOidcToken (/home/runner/work/_actions/anthropics/claude-code-action/v1/src/github/token.ts:58:34)
      at retryWithBackoff (/home/runner/work/_actions/anthropics/claude-code-action/v1/base-action/src/retry.ts:27:20)

Attempt 1 failed: Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions?
...
Attempt 3 failed: Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions?
Operation failed after 3 attempts

##[error]Action failed with error: Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions?
##[error]Process completed with exit code 1.

Analysis

This is a workflow configuration failure, not a flaky test or transient infrastructure issue. The .github/workflows/release-notes.yml job update-release-notes declares:

permissions:
  contents: write
  pull-requests: write

It is missing id-token: write. The anthropics/claude-code-action/v1 action uses GitHub OIDC token exchange to authenticate with the Anthropic API (when no API key is provided via OIDC federation), and this requires the id-token: write permission to be set on the job. The fix is to add id-token: write to the update-release-notes job permissions in release-notes.yml.

---

Reported by Flaky Failure Watcher