Remove unused id-token: write from deep-review workflow

[michael-anastasakis]

Removes id-token: write from deep-review.yml's job permissions block. The grant is unused — the workflow passes github_token: ${{ secrets.GITHUB_TOKEN }} explicitly to claude-code-action (so the action doesn't need to mint one via OIDC exchange), and no other step in the file consumes an OIDC token.

Why

Empirical testing against Anthropic's github-app-token-exchange endpoint confirmed that when a workflow passes github_token: explicitly, the OIDC path is not exercised. Any id-token: write grant in that case is dead weight — an attacker who compromises the workflow (via prompt injection etc.) could still curl the OIDC endpoint and get a token usable against any cloud trust policy that trusts GitHub Actions from this repo.

Removing it costs nothing and shrinks the OIDC attack surface. Part of the LLM-in-CI security audit.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 04e2b99

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Deep Review

The one-line permission removal itself checks out clean: every step in the job either passes an explicit token (actions/github-script@v9, anthropics/claude-code-action@v1) or relies on github.token (actions/checkout@v6, peter-evans/*), and no step requests an OIDC token. The remaining contents: read / pull-requests: write / issues: write / actions: read set still covers every API call the job makes. Findings below are about the surrounding workflow, which review of this file surfaced.

🔴 P0/P1 -- must fix

• .github/workflows/deep-review.yml:70 -- Pre-existing: the pull_request_target job checks out fork-controlled PR head code and then runs the agent with --setting-sources project,user, so the tracked .claude/settings.json a fork supplies is loaded inside a job holding secrets.ANTHROPIC_API_KEY and a write-scoped GITHUB_TOKEN, while allowed_non_write_users: '*' removes the contributor gate.
  • Fix: Drop project from --setting-sources, or point --settings at a base-branch-controlled path, and move the privileged comment-posting steps into a job separate from the untrusted checkout.
  • _security

🟡 P2 -- recommended

• .github/workflows/deep-review.yml:4 -- Because pull_request_target executes the workflow definition from the base branch, this PR's own CI run still uses the old permissions block, so the reduced-permission job is unexercised until it lands on main.
  • Fix: After merge, trigger the workflow_dispatch path against a known PR number and confirm the Run deep review step still authenticates.
  • _{correctness, security}

🔵 P3 nitpicks (4)

• .github/workflows/deep-review.yml:96 -- anthropics/claude-code-action@v1 is a floating major tag, so a future release that adds an OIDC-dependent code path would break this job with no diff in this repo and nothing recording that the permission was dropped deliberately.
  • Fix: Pin the action to a commit SHA and add a one-line comment above permissions: stating that OIDC is intentionally not granted.
• AGENTS.md:74 -- The branch name drop-idtoken-deep-review omits the required warren/ prefix.
  • Fix: Rename the branch to carry the warren/ prefix.
• AGENTS.md:77 -- The commit subject has no conventional-commit type prefix.
  • Fix: Reword the subject with a ci: prefix.
• AGENTS.md:151 -- Pre-existing: the CI Workflows table documents four workflows and omits deep-review.yml.
  • Fix: Add a deep-review.yml row to the CI Workflows table.

---

Reviewers (6): correctness, security, reliability, testing, maintainability, project-standards

Testing gaps:

• No actionlint or permissions-lint job exists, so a future regression that reintroduces an OIDC dependency without restoring the grant is caught only by a red job at runtime.
• Whether anthropics/claude-code-action@v1 skips its OIDC exchange when github_token is supplied could not be confirmed from this checkout -- the action is not vendored and network fetch was unavailable; if the assumption is wrong the Run deep review step fails loudly rather than posting a degraded comment, since no step sets continue-on-error.