Adding one permission such as id-token: write makes actions/checkout fail with 'Repository not found'

remote: Repository not found.

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

As soon as a permissions block lists any scope, every scope not listed is set to none. Adding id-token: write for OIDC silently removes contents: read, which checkout needs on private repositories.

Fix

List every scope the job uses alongside the new one.

Apply

permissions:
  id-token: write
  contents: read

Affects: GitHub Actions workflows with a permissions key, private and internal repositories, as of October 2026

Sources

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp