From dabf261eb734998b23228d40d27f7ae76b6c7f16 Mon Sep 17 00:00:00 2001 From: s1d3sw1ped_bot Date: Wed, 2 Sep 2026 15:01:08 +0000 Subject: [PATCH] ci: Migrate release to job GITEA_TOKEN Release Tag still authenticates GoReleaser with secrets.RELEASE_TOKEN, a legacy PAT that CI policy no longer wants refreshed. Prefer the job built-in token with contents: write, mirror it into GITHUB_TOKEN the way vulture does, and force GoReleaser onto the Gitea token path. Link: https://git.s1d3sw1ped.com/s1d3sw1ped/teleport/issues/11 --- .gitea/workflows/release-tag.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/release-tag.yaml b/.gitea/workflows/release-tag.yaml index 1f46fca..3be8186 100644 --- a/.gitea/workflows/release-tag.yaml +++ b/.gitea/workflows/release-tag.yaml @@ -7,6 +7,8 @@ on: jobs: release: runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@main with: @@ -21,4 +23,7 @@ jobs: version: 'latest' args: release env: - GITEA_TOKEN: ${{secrets.RELEASE_TOKEN}} \ No newline at end of file + GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} + # Prefer Gitea when the runner also injects GITHUB_TOKEN. + GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }} + GORELEASER_FORCE_TOKEN: gitea