Cached tasks do not receive the GitHub Actions environment variables required to request an OIDC token:
ACTIONS_ID_TOKEN_REQUEST_URLACTIONS_ID_TOKEN_REQUEST_TOKEN
This causes tools such as npm Trusted Publishing to incorrectly conclude that the workflow lacks id-token: write permissions.
Originally reported in: voidzero-dev/vite-plus#2189
Minimal reproduction: https://github.com/naokihaba/vite-plus-issue-2189-repro
Proposed fix
Add the two exact variables to DEFAULT_UNTRACKED_ENV:
// /Users/xxxxx/.cargo/git/checkouts/vite-task-b9d2f8c2bec84a8f/d05b1dc/crates/vt_graph/src/config/mod.rs
// GitHub Actions
"GITHUB_*",
"RUNNER_*",
"ACTIONS_ID_TOKEN_REQUEST_URL",
"ACTIONS_ID_TOKEN_REQUEST_TOKEN",
Using the exact names rather than a broad ACTIONS_* pattern avoids forwarding unrelated GitHub Actions runtime variables.
These variables should be untracked rather than fingerprinted because the request token is ephemeral and should not invalidate the task cache.
A regression test can supply dummy values for both variables and verify that they remain in the spawned environment for a cached task.
Cached tasks do not receive the GitHub Actions environment variables required to request an OIDC token:
ACTIONS_ID_TOKEN_REQUEST_URLACTIONS_ID_TOKEN_REQUEST_TOKENThis causes tools such as npm Trusted Publishing to incorrectly conclude that the workflow lacks
id-token: writepermissions.Originally reported in: voidzero-dev/vite-plus#2189
Minimal reproduction: https://github.com/naokihaba/vite-plus-issue-2189-repro
Proposed fix
Add the two exact variables to DEFAULT_UNTRACKED_ENV:
Using the exact names rather than a broad ACTIONS_* pattern avoids forwarding unrelated GitHub Actions runtime variables.
These variables should be untracked rather than fingerprinted because the request token is ephemeral and should not invalidate the task cache.
A regression test can supply dummy values for both variables and verify that they remain in the spawned environment for a cached task.