EQUEST cicd authentication ai_generated true

Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable

ID: cicd/gha-oidc-token-failed

Also available as: JSON · Markdown
92%Fix Rate
93%Confidence
80Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

GitHub Actions OIDC token request fails because the workflow or job does not have 'permissions: id-token: write' set. The ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables are only injected when this permission is explicitly granted. This commonly occurs when configuring keyless authentication to AWS, GCP, or Azure.

generic

Workarounds

  1. 95% success Add 'permissions: id-token: write' to the job that requests the OIDC token 
    In the workflow YAML, add a 'permissions' block at the job level: 'jobs: deploy: permissions: id-token: write contents: read'. Note that when you specify any permissions, all other permissions default to 'none', so you must explicitly include all required permissions (e.g., contents: read for checkout).
  2. 93% success Add 'permissions: id-token: write' at the workflow level with all other needed permissions 
    Add a top-level 'permissions' block: 'permissions: id-token: write contents: read packages: read'. This applies to all jobs in the workflow. Remember that setting workflow-level permissions overrides the default token permissions entirely, so list every permission you need.
  3. 88% success Verify the cloud provider trust policy matches the workflow's OIDC claims 
    After fixing the id-token permission, ensure the cloud provider's trust policy (AWS IAM role trust policy, GCP Workload Identity pool, or Azure federated credential) correctly matches the GitHub OIDC token claims: repository, ref, environment, and job_workflow_ref. Mismatched claims cause authentication to fail after token issuance.

Dead Ends

Common approaches that don't work:

  1. Set the ACTIONS_ID_TOKEN_REQUEST_URL environment variable manually 99% fail

    The OIDC token endpoint URL is dynamically generated by the GitHub Actions runner and includes a unique per-job authentication token. There is no static URL to set; the variable is only populated when the id-token permission is granted.

  2. Use a personal access token (PAT) as a substitute for OIDC authentication 55% fail

    PATs are long-lived static credentials that must be stored as secrets, rotated manually, and pose a security risk if leaked. This defeats the entire purpose of OIDC, which provides short-lived, keyless authentication. Many organizations block this approach via policy.

  3. Add id-token permission at the step level instead of the job or workflow level 99% fail

    GitHub Actions does not support permissions at the step level. Permissions can only be defined at the top-level 'permissions' key (workflow-wide) or within a specific 'jobs.<job_id>.permissions' block. Step-level permissions are silently ignored.

Error Chain

Leads to:
Preceded by:
Frequently confused with: