How to give variables read/write permissions to the token in a workflow?

[Grsz]

Select Topic Area

Question

Body

I want to manage my github actions variables in terraform, and I want to plan/apply my terraform in a github actions workflow. In order to do that, I need to give the access token of the workflow access to /repos/{owner}/{repo}/actions/variables.

I gave it:

permissions:
  id-token: write
  contents: write
  actions: write

but I still get: 403 Resource not accessible by integration [].

Based on the documentation it needs read/write access (depending on crud op), but to what? The title says Repository permissions for "Variables", and afaik repo permissions is equal to contents.

Should I create a fine grained PAT instead, store it in a secret, and overwrite the default access token provided to the workflow in the env vars of the job?