Grant test build wheel workflows with correct permissions

[huydhn]

This needs to be add to the test workflows after #4865

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
torchci	⬜️ Ignored (Inspect)	Visit Preview		Jan 12, 2024 1:20am

[malfet]

Those are test workflows that never upload anything, why do they need id-token: write?

[huydhn]

Those are test workflows that never upload anything, why do they need id-token: write?

They don’t do that directly, but they invoke the wheel build reusable workflow, which requires id-token write permission. Without the change, the caller will have id-token none permission default and will not escalate that to id-token write required by OIDC step. I need to do the same for all domains, i.e. vision pytorch/vision#8205.

You can see the failure here https://github.com/pytorch/test-infra/actions/runs/7496638182

[huydhn]

According to GH doc, id-token write is the permission to actually query ODIC https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-permissions-settings

For reusable workflows outside your enterprise or organization, the permissions setting for id-token should be explicitly set to write at the caller workflow level or in the specific job that calls the reusable workflow. This ensures that the OIDC token generated in the reusable workflow is only allowed to be consumed in the caller workflows when intended.