Fix release workflow: token permissions + archived action - #14
Open
EdgarBabajanyan wants to merge 1 commit into
Open
Fix release workflow: token permissions + archived action#14EdgarBabajanyan wants to merge 1 commit into
EdgarBabajanyan wants to merge 1 commit into
Conversation
…elease action The v0.4.0 tag run failed at Create Release with 'Resource not accessible by integration' — the default GITHUB_TOKEN is read-only and the workflow declared no permissions, so the release had to be created manually. Grant contents:write, and swap the archived actions/create-release@v1 (plus its brittle %0A body escaping) for gh release create reading the CHANGELOG section from a file, skipping cleanly when the release already exists. Signed-off-by: Edgar Babajanyan <bedgar2005@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The v0.4.0 tag run failed at the Create Release step:
The workflow declares no
permissions, so the defaultGITHUB_TOKENis read-only and cannot create releases; the v0.4.0 release had to be created manually. ThePublish to crates.iojob was skipped as a knock-on (needs: create-release).Fix
permissions: contents: writeat the workflow level.actions/create-release@v1(and its%0Abody-escaping dance) withgh release createreading the CHANGELOG section from a file — idempotent when the release already exists, so re-running a tag build can't fail on a duplicate.Notes
Publish to crates.iousessecrets.CARGO_TOKEN— confirm that secret exists before the next tagged release, or the job will fail there instead.