The https://github.com/actions/create-github-app-token/blob/main/action.yml#L30 main action file is missing the `permissions-attestations` input, which is listed in https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app . Maybe the action needs a run of regeneration of the inputs :)