Function validateOIDCPermissions

pkg/workflow/permissions_compiler_validator.go:225–256

(workflowData *WorkflowData, workflowPermissions *Permissions)

}

func validateOIDCPermissions(workflowData *WorkflowData, workflowPermissions *Permissions) error {
	if workflowData == nil {
		return nil
	}

	requiresIDTokenWrite := false
	errorPrefix := ""

	if workflowData.EngineConfig != nil && workflowData.EngineConfig.Auth != nil && workflowData.EngineConfig.Auth.Type == "github-oidc" {
		requiresIDTokenWrite = true
		errorPrefix = "engine.auth.type: github-oidc"
	}

	if !requiresIDTokenWrite && hasOTLPGitHubOIDCAuth(workflowData.ParsedFrontmatter, workflowData.RawFrontmatter) {
		requiresIDTokenWrite = true
		errorPrefix = "observability.otlp.github-app"
	}

	if !requiresIDTokenWrite {
		return nil
	}

	if workflowPermissions == nil {
		return errors.New(errorPrefix + " requires permissions.id-token: write")
	}

	if level, exists := workflowPermissions.Get(PermissionIdToken); !exists || level != PermissionWrite {
		return errors.New(errorPrefix + " requires permissions.id-token: write")
	}

	return nil
}