White_Ghost_Cyber_Systems/traefik-control
3
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases 4 Packages 2 Wiki Activity Actions

fix(release): use the job token for repository calls #28

Merged
ryan.mcgee merged 1 commit from ci/release-repo-token into main 2026-10-20 19:32:06 +00:00
Conversation 0 Commits 1 Files changed 5 +23 -13
ryan.mcgee commented 2026-10-20 19:23:32 +00:00
Owner
Copy link

Summary

  • The 1.0.0 release run failed 7 seconds in, before any build. REGISTRY_TOKEN cannot also carry repository scopes (the forge refuses package scopes on a token limited to repositories), so the repository calls in scripts/release.sh had no credential.

Changes

  • scripts/release.sh: new REPO_TOKEN for git fetch, the release lookup and release creation; TOKEN is used only for the registry and package calls.
  • .github/workflows/release.yml: pass github.token as REPO_TOKEN; REGISTRY_TOKEN needs write:package only.
  • README and workflow comments: corrected token scopes.

Verification

  • A throwaway workflow on a separate branch, running with the job's github.token, fetched main, looked up a release (404 as expected) and created then deleted a draft release: all succeeded.
  • shellcheck -x and actionlint clean; release.sh refuses to run with PUSH=1 and no REPO_TOKEN.
  • Not run: the release workflow itself (needs a tag).
## Summary - The 1.0.0 release run failed 7 seconds in, before any build. `REGISTRY_TOKEN` cannot also carry repository scopes (the forge refuses package scopes on a token limited to repositories), so the repository calls in `scripts/release.sh` had no credential. ## Changes - `scripts/release.sh`: new `REPO_TOKEN` for `git fetch`, the release lookup and release creation; `TOKEN` is used only for the registry and package calls. - `.github/workflows/release.yml`: pass `github.token` as `REPO_TOKEN`; `REGISTRY_TOKEN` needs `write:package` only. - README and workflow comments: corrected token scopes. ## Verification - A throwaway workflow on a separate branch, running with the job's `github.token`, fetched `main`, looked up a release (404 as expected) and created then deleted a draft release: all succeeded. - `shellcheck -x` and `actionlint` clean; `release.sh` refuses to run with `PUSH=1` and no `REPO_TOKEN`. - Not run: the release workflow itself (needs a tag).
fix(release): use the job token for repository calls
All checks were successful
CI / format, compile, credo, dialyzer (pull_request) Successful in 1m23s
Details
CI / tests (SQLite) (pull_request) Successful in 2m17s
Details
CI / dependency audit (pull_request) Successful in 44s
Details
Development images / images (push) Successful in 13s
Details
CI / tests (PostgreSQL) (pull_request) Successful in 2m10s
Details
9421339b50 
- a token limited to repositories cannot hold package scopes, so
  REGISTRY_TOKEN carries write:package only
- fetch main, look up and create the release with github.token
  (REPO_TOKEN in release.sh)
ryan.mcgee deleted branch ci/release-repo-token 2026-10-20 19:32:07 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
White_Ghost_Cyber_Systems/traefik-control!28
No description provided.