ci: Migrate release off RELEASE_TOKEN to job GITEA_TOKEN #9

New issue

Closed

opened 2026-09-02 14:54:33 +00:00 by Ghost · 1 comment

Ghost commented

2026-09-02 14:54:33 +00:00

Draft for review — do not implement/merge without Eva review

Migrate CI release off legacy secrets.RELEASE_TOKEN to the job built-in token (secrets.GITEA_TOKEN / runner GITEA_TOKEN).

Policy (Eva / Rex CI token policy)

Prefer secrets.GITEA_TOKEN with job permissions: contents: write.
For GoReleaser: set GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} and GORELEASER_FORCE_TOKEN: gitea (and typically mirror into GITHUB_TOKEN the same way vulture does).
Prefer gitea-release-action@v1 when not using GoReleaser.
Do not invent a new RELEASE_TOKEN PAT.
On steamcache2, RELEASE_TOKEN is known legacy — replace with job token; do not refresh/extend that PAT.

Reference implementations (already migrated)

GoReleaser path: s1d3sw1ped/vulture (.gitea/workflows/release-tag.yaml)
release-action path: s1d3sw1ped/scratchbox, s1d3sw1ped/helix-proxy, s1d3sw1ped/SwipedModSwitcher, s1d3sw1ped/grok-bot-bin

Status

DRAFT — open for Eva review only. No PR/merge until approved.

## Draft for review — do not implement/merge without Eva review Migrate CI release off legacy `secrets.RELEASE_TOKEN` to the job built-in token (`secrets.GITEA_TOKEN` / runner `GITEA_TOKEN`). ### Policy (Eva / Rex CI token policy) - Prefer **`secrets.GITEA_TOKEN`** with job **`permissions: contents: write`**. - For **GoReleaser**: set `GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}` and `GORELEASER_FORCE_TOKEN: gitea` (and typically mirror into `GITHUB_TOKEN` the same way vulture does). - Prefer **`gitea-release-action@v1`** when not using GoReleaser. - **Do not invent** a new `RELEASE_TOKEN` PAT. - On **steamcache2**, `RELEASE_TOKEN` is known legacy — replace with job token; do not refresh/extend that PAT. ### Reference implementations (already migrated) - GoReleaser path: `s1d3sw1ped/vulture` (`.gitea/workflows/release-tag.yaml`) - release-action path: `s1d3sw1ped/scratchbox`, `s1d3sw1ped/helix-proxy`, `s1d3sw1ped/SwipedModSwitcher`, `s1d3sw1ped/grok-bot-bin` ### Status **DRAFT** — open for Eva review only. No PR/merge until approved.

Ghost added the

draft

label

2026-09-02 14:54:33 +00:00

Ghost referenced this issue

2026-09-02 15:03:55 +00:00

.gitea/workflows: Prefer job GITEA_TOKEN #10

Ghost referenced this issue from a commit

2026-09-02 15:03:55 +00:00

ci: Migrate release to job GITEA_TOKEN

Ghost referenced this issue from a commit

2026-09-02 15:09:48 +00:00