GitHub Actions actions/attest-build-provenance "id-token permission"

By Kaveh Alemi·Latchkey

actions/attest-build-provenance signs provenance using a Sigstore OIDC token and writes the attestation to the repository. It needs id-token: write to mint the token and attestations: write to store the result.

What this error means

An attest-build-provenance step fails saying it could not get an OIDC token or could not write the attestation, citing permissions.

Error: Failed to get OIDC token: missing id-token permission
Error: Resource not accessible by integration (createAttestation)

Common causes

Missing id-token: write

Without it the action cannot obtain the Sigstore signing token.

Missing attestations: write

Without it the action cannot store the generated attestation on the repository.

How to fix it

Grant the required permissions

1. Add permissions: id-token: write, attestations: write, and contents: read.
2. Run the step after the artifact is built.
3. Point subject-path at the built artifact.

permissions:
  id-token: write
  attestations: write
  contents: read
steps:
  - uses: actions/attest-build-provenance@v1
    with:
      subject-path: dist/app.tar.gz

How to prevent it

• Set id-token and attestations write permissions on provenance jobs.
• Keep the attestation step scoped to trusted (non-fork) triggers.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions