Add attestations: write permission to app-builder workflow

[Copilot]

The attest job fails with "Resource not accessible by integration" when calling actions/attest-build-provenance. The workflow defines an explicit permissions block that overrides inherited permissions from the parent workflow.

Changes

• Added attestations: write to the permissions block in .github/workflows/app-builder.yaml

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write  # Added

The parent release.yaml workflow passes attestations: write, but when a reusable workflow defines its own permissions block, it replaces rather than extends the inherited permissions.

Original prompt

The attest job in the App Builder workflow is failing with "Resource not accessible by integration" error when attempting to create attestations. This is because the app-builder.yaml workflow is missing the attestations: write permission in its permissions block.

While the parent release.yaml workflow correctly passes attestations: write to the called workflow, the app-builder.yaml defines its own permissions block that overrides the inherited permissions. The permissions section currently only includes:

• contents: read
• packages: write
• id-token: write

The attestations: write permission needs to be explicitly added to allow the actions/attest-build-provenance action to successfully create and persist attestations.

Fix: Add attestations: write to the permissions block in .github/workflows/app-builder.yaml

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.