.gitea/workflows: Prefer job GITEA_TOKEN #27

2026-09-02T10:01:37-05:00

Ghost commented

2026-09-02 10:01:37 -05:00

What

Update .gitea/workflows/release-tag.yaml so the release job uses the built-in job token instead of legacy secrets.RELEASE_TOKEN:

Add job permissions: contents: write
Set GITEA_TOKEN / GITHUB_TOKEN from ${{ secrets.GITEA_TOKEN }}
Set GORELEASER_FORCE_TOKEN: gitea
Keep GoReleaser; do not invent a new RELEASE_TOKEN PAT

Why

steamcache2 still wired release to a legacy RELEASE_TOKEN PAT. Eva/Rex CI token policy prefers secrets.GITEA_TOKEN with contents: write (same pattern as vulture). An empty Secrets UI entry for GITEA_TOKEN is normal — the runner injects the job token.

Issue: #26

Test

Diff is workflow-only (no product code).
After merge, next tag push should publish via GoReleaser using the job token.

## What Update `.gitea/workflows/release-tag.yaml` so the release job uses the built-in job token instead of legacy `secrets.RELEASE_TOKEN`: - Add job `permissions: contents: write` - Set `GITEA_TOKEN` / `GITHUB_TOKEN` from `${{ secrets.GITEA_TOKEN }}` - Set `GORELEASER_FORCE_TOKEN: gitea` - Keep GoReleaser; do not invent a new RELEASE_TOKEN PAT ## Why steamcache2 still wired release to a legacy RELEASE_TOKEN PAT. Eva/Rex CI token policy prefers `secrets.GITEA_TOKEN` with `contents: write` (same pattern as vulture). An empty Secrets UI entry for `GITEA_TOKEN` is normal — the runner injects the job token. Issue: https://git.s1d3sw1ped.com/s1d3sw1ped/steamcache2/issues/26 ## Test - Diff is workflow-only (no product code). - After merge, next tag push should publish via GoReleaser using the job token.

Ghost added 1 commit 2026-09-02 10:01:38 -05:00

ci: Migrate release to job GITEA_TOKEN

CI / vulncheck (pull_request) Successful in 14s

Details

CI / check-and-test (pull_request) Successful in 42s

Details

ac05200c79

Release Tag still points GITEA_TOKEN at secrets.RELEASE_TOKEN, a
legacy PAT. Prefer the job built-in token with contents: write,
mirroring GITHUB_TOKEN and forcing GoReleaser onto the gitea path
so tag pushes publish without that PAT.

Link: #26

Ghost changed title from ~~ci: Migrate release to job GITEA_TOKEN~~ to .gitea/workflows: Prefer job GITEA_TOKEN

2026-09-02 10:07:41 -05:00

Ghost merged commit 3f5175b482 into main

2026-09-02 10:08:01 -05:00

Ghost deleted branch ash/ci-gitea-token-release

2026-09-02 10:08:01 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: s1d3sw1ped/steamcache2#27