id-token: write permission is always required

[JuneStepp]

I currently get an error even when not using niks3 just due to the sub-action request of id-token: write.

[stepbrobd]

do you mind sharing the log for this (preferably the action link)

[JuneStepp]

do you mind sharing the log for this (preferably the action link)

Here you go: https://github.com/vanilla-mobile-nixos/vanilla-mobile-nixos/actions/runs/27500389420

The error is: The workflow is not valid. .github/workflows/build.yml (Line: 8, Col: 3): Error calling workflow 'JuneStepp/atelier/.github/workflows/discover.yaml@66abc79f1aadc350a5f19ebedefd16d41d06a884'. The nested job 'Build' is requesting 'id-token: write', but is only allowed 'id-token: none'.

[stepbrobd]

i think this is really hard per docs

https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#access-and-permissions-for-nested-workflows

https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#nesting-reusable-workflows

called workflows must have the same permission level or lower