chore: add id-token write (#826)

* chore: add id-token write

* pin coverage version

* update macos

* remove 3.8

* remove more versions

Author: seebees

.github/workflows/ci_integration.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          python-version: '3.13'
 
       - name: Install dependencies
         run: |

.github/workflows/ci_tests.yaml

@@ -24,7 +24,7 @@ jobs:
           # x86 builds are only meaningful for Windows
           - os: windows-latest
             architecture: x86
-          - os: macos-13
+          - os: macos-latest
             architecture: x64
         python:
           - 3.8
@@ -35,6 +35,18 @@ jobs:
 #          - 3.x  3.13 does not have 'pipes' and maybe other necessary things
         category:
           - local-slow
+        exclude:
+          # Python < 3.11 is broken on macOS runners due to missing libintl dependency
+          # See: https://github.com/actions/setup-python/issues/875
+          - platform:
+              os: macos-latest
+            python: 3.8
+          - platform:
+              os: macos-latest
+            python: 3.9
+          - platform:
+              os: macos-latest
+            python: "3.10"
 # These require credentials.
 # Enable them once we sort how to provide them.
 #          - integ-slow

.github/workflows/pull.yml

@@ -5,6 +5,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   call-integration-tests: