ci: Migrate release to job GITEA_TOKEN #12

Merged

Ghost merged 1 commit from ash/ci-gitea-token-release into master

2026-09-02 15:06:21 +00:00

Ghost commented

2026-09-02 15:01:17 +00:00

What

Migrate .gitea/workflows/release-tag.yaml off secrets.RELEASE_TOKEN to the job built-in token: add permissions: contents: write, set GITEA_TOKEN / mirrored GITHUB_TOKEN from secrets.GITEA_TOKEN, and set GORELEASER_FORCE_TOKEN=gitea. GoReleaser stays.

Why

CI token policy prefers job GITEA_TOKEN over a refreshable release PAT. Same pattern as s1d3sw1ped/vulture.

Test

Workflow YAML validates and still invokes goreleaser-action on tag push.
After merge, cut a test tag and confirm the release job publishes with the job token (no RELEASE_TOKEN).

Link: #11

## What Migrate `.gitea/workflows/release-tag.yaml` off `secrets.RELEASE_TOKEN` to the job built-in token: add `permissions: contents: write`, set `GITEA_TOKEN` / mirrored `GITHUB_TOKEN` from `secrets.GITEA_TOKEN`, and set `GORELEASER_FORCE_TOKEN=gitea`. GoReleaser stays. ## Why CI token policy prefers job `GITEA_TOKEN` over a refreshable release PAT. Same pattern as `s1d3sw1ped/vulture`. ## Test - Workflow YAML validates and still invokes goreleaser-action on tag push. - After merge, cut a test tag and confirm the release job publishes with the job token (no RELEASE_TOKEN). Link: https://git.s1d3sw1ped.com/s1d3sw1ped/teleport/issues/11

Ghost added 1 commit

2026-09-02 15:01:17 +00:00

ci: Migrate release to job GITEA_TOKEN

CI / check-and-test (pull_request) Successful in 17s

Details

dabf261eb7

Release Tag still authenticates GoReleaser with secrets.RELEASE_TOKEN, a
legacy PAT that CI policy no longer wants refreshed. Prefer the job
built-in token with contents: write, mirror it into GITHUB_TOKEN the way
vulture does, and force GoReleaser onto the Gitea token path.

Link: #11

Ghost merged commit c6f976bb10 into master

2026-09-02 15:06:21 +00:00