From d43b9abd78c092bade725d44b14e3ef3ebed9eaf Mon Sep 17 00:00:00 2001 From: jamesread Date: Thu, 10 Sep 2026 20:37:42 +0100 Subject: [PATCH] fix: authenticate release git pushes with CONTAINER_TOKEN Keep workflow contents:read for PR safety, stop persisting the read-only GITHUB_TOKEN into git config, and configure release pushes to use CONTAINER_TOKEN instead. Co-authored-by: Cursor --- .github/workflows/build-and-release.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml index 15f35ac7..2422fbde 100644 --- a/.github/workflows/build-and-release.yml +++ b/.github/workflows/build-and-release.yml @@ -71,6 +71,8 @@ jobs: uses: actions/checkout@v6 with: fetch-depth: ${{ env.WILL_PUBLISH == 'true' && '0' || '1' }} + # Keep the read-only GITHUB_TOKEN out of git config so release uses CONTAINER_TOKEN. + persist-credentials: false - name: Set up QEMU if: env.WILL_PUBLISH == 'true' @@ -168,6 +170,20 @@ jobs: MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} run: ./var/macos/verify-macos-sign-p12.sh + - name: Authenticate git for release + if: env.WILL_PUBLISH == 'true' + env: + CONTAINER_TOKEN: ${{ secrets.CONTAINER_TOKEN }} + run: | + if [[ -z "${CONTAINER_TOKEN}" ]]; then + echo "CONTAINER_TOKEN is required for semantic-release git push on main." >&2 + exit 1 + fi + # Prefer CONTAINER_TOKEN over the workflow's read-only GITHUB_TOKEN for git operations. + basic="$(printf 'x-access-token:%s' "${CONTAINER_TOKEN}" | base64 -w 0)" + git config --local --unset-all http.https://github.com/.extraheader || true + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic}" + - name: release id: release if: env.WILL_PUBLISH == 'true'