chore: add id-token write

.github/workflows/ci_integration.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          python-version: '3.13'
 
       - name: Install dependencies
         run: |

.github/workflows/ci_tests.yaml

@@ -24,7 +24,7 @@ jobs:
           # x86 builds are only meaningful for Windows
           - os: windows-latest
             architecture: x86
-          - os: macos-13
+          - os: macos-latest
             architecture: x64
         python:
           - 3.8
@@ -35,6 +35,11 @@ jobs:
 #          - 3.x  3.13 does not have 'pipes' and maybe other necessary things
         category:
           - local-slow
+        exclude:
+          # Python 3.8 is broken on macOS-latest runners due to missing libintl dependency
+          - platform:
+              os: macos-latest
+            python: 3.8
 # These require credentials.
 # Enable them once we sort how to provide them.
 #          - integ-slow

.github/workflows/pull.yml

@@ -5,6 +5,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   call-integration-tests: