Skip to content

ci: use release PAT for protected tags - #1419

Merged
TerryHowe merged 1 commit into
oras-project:mainfrom
Ricky-7-Yan:fix/1411-release-pat
Sep 11, 2026
Merged

TerryHowe merged 1 commit into
oras-project:mainfrom
Ricky-7-Yan:fix/1411-release-pat

Conversation

@Ricky-7-Yan

Copy link
Copy Markdown
Contributor

Summary

  • persist the existing RELEASE_PAT repository secret in the main-branch release checkout
  • authenticate protected tag pushes as the ruleset-bypass-eligible token owner
  • keep GoReleaser on the workflow GITHUB_TOKEN

This mirrors the already merged v2 fix in #1371.

Verification

  • YAML parsed successfully with PyYAML
  • .github/workflows/release.yml remains LF-only
  • git diff --check passed
  • the three-line workflow change matches ci: authenticate v2 release tag push with RELEASE_PAT #1371 exactly
  • go test ./... was attempted with Go 1.26; unrelated Windows-only baseline failures remain around symlink privilege, Unix file modes, XDG paths, and file://C:\... URL handling
  • race mode is unavailable locally because CGO is disabled

The protected tag push can only be verified by the next repository release workflow.

Fixes #1411

@codecov

codecov Bot commented Sep 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.85%. Comparing base (267e33e) to head (f4facc6).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1419   +/-   ##
=======================================
  Coverage   90.85%   90.85%           
=======================================
  Files          95       95           
  Lines        7304     7304           
=======================================
  Hits         6636     6636           
  Misses        656      656           
  Partials       12       12           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@TerryHowe TerryHowe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@TerryHowe
TerryHowe merged commit 7317c1b into oras-project:main Sep 11, 2026
10 checks passed
@TerryHowe

Copy link
Copy Markdown
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: main release workflow cannot push tags; needs RELEASE_PAT to bypass tag ruleset

2 participants