fix(release): skip the docker pipe so the CLI release can ship - #49
Merged
Conversation
The release now builds cleanly and dies at the very last step:
denied: installation not allowed to Write organization package
go-binary-release.yml's `goreleaser` job declares `permissions: contents: write`
and nothing else, and once a permissions block exists everything unlisted is
`none` -- so its GITHUB_TOKEN has `packages: none` while the docker path logs in
as exactly that token and pushes. The called workflow's block is authoritative
for its own jobs, so the `packages: write` this job already declares cannot
widen it, and GORELEASER_TOKEN never reaches the login step, which hardcodes
secrets.GITHUB_TOKEN. Nothing in this repository can grant the scope.
Note `docker: false` alone would have made it worse rather than better: that
input only skips QEMU, Buildx and the registry *login*, while .goreleaser.yml
still carries dockers/docker_manifests -- so GoReleaser would build the images
and then push them unauthenticated. The pipe has to be skipped in GoReleaser
itself, which is what `--skip=docker` does; the setup steps are then simply
unnecessary, hence both lines.
Verified locally: with `--skip=docker` GoReleaser reports "skipping ... docker"
and dist/artifacts.json contains Archive, Binary, Checksum, Homebrew Formula,
Linux Package, Metadata and Scoop Manifest -- every artifact except the images.
Temporary. xraph/workflows#1 grants the permission properly; this reverts once
that lands and its v1 tag moves.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Conventional Commits ValidationPR Title: valid |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the CLI release. The build itself is now fine — this is the last step failing.
The failure
Six minutes of successful build, then a permission denial on the push.
Why nothing in this repo can fix it properly
go-binary-release.yml'sgoreleaserjob declarespermissions: contents: writeand nothing else. Once apermissions:block exists, everything unlisted isnone— so itsGITHUB_TOKENhaspackages: none, while the docker path logs into ghcr.io as exactly that token and pushes.packages: writethis job already declares cannot widen it.GORELEASER_TOKENnever reaches the login step, which hardcodessecrets.GITHUB_TOKEN.Why
docker: falsealone is not the answerThat input only skips QEMU, Buildx and the registry login.
.goreleaser.ymlstill carriesdockers+docker_manifests, so GoReleaser would build the images and then push them unauthenticated — a worse failure than the current one. The pipe has to be skipped in GoReleaser itself, via--skip=docker. With that done the setup steps are simply unnecessary, hence both lines change together.Verification
Run locally against this config:
skipping announce, docker, publish, and validate.dist/artifacts.jsoncontainsArchive, Binary, Checksum, Homebrew Formula, Linux Package, Metadata, Scoop Manifest— every artifact except the images.release.ymlparses.Temporary
xraph/workflows#1 grants
packages: writeproperly. Revert both lines here once it lands and thev1tag moves — this repo pins@v1, so merging alone won't restore images. The comment in the diff says so and links the PR.🤖 Generated with Claude Code