From 4782028019bd8d843716d0fbf947f80a3e4d5a14 Mon Sep 17 00:00:00 2001
From: Rex Raphael <rex.raphael@outlook.com>
Date: Fri, 7 Aug 2026 11:57:03 -0500
Subject: [PATCH] fix(release): skip the docker pipe so the CLI release can
 ship

The release now builds cleanly and dies at the very last step:

    denied: installation not allowed to Write organization package

go-binary-release.yml's `goreleaser` job declares `permissions: contents: write`
and nothing else, and once a permissions block exists everything unlisted is
`none` -- so its GITHUB_TOKEN has `packages: none` while the docker path logs in
as exactly that token and pushes. The called workflow's block is authoritative
for its own jobs, so the `packages: write` this job already declares cannot
widen it, and GORELEASER_TOKEN never reaches the login step, which hardcodes
secrets.GITHUB_TOKEN. Nothing in this repository can grant the scope.

Note `docker: false` alone would have made it worse rather than better: that
input only skips QEMU, Buildx and the registry *login*, while .goreleaser.yml
still carries dockers/docker_manifests -- so GoReleaser would build the images
and then push them unauthenticated. The pipe has to be skipped in GoReleaser
itself, which is what `--skip=docker` does; the setup steps are then simply
unnecessary, hence both lines.

Verified locally: with `--skip=docker` GoReleaser reports "skipping ... docker"
and dist/artifacts.json contains Archive, Binary, Checksum, Homebrew Formula,
Linux Package, Metadata and Scoop Manifest -- every artifact except the images.

Temporary. xraph/workflows#1 grants the permission properly; this reverts once
that lands and its v1 tag moves.
---
 .github/workflows/release.yml | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 051d8ec1..b91fddf6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -306,11 +306,33 @@ jobs:
     with:
       # Read the version from go.mod rather than duplicating it here.
       go-version-file: go.mod
-      # .goreleaser.yml has dockers + docker_manifests; multi-arch images
-      # cannot cross-build without QEMU.
-      docker: true
+      # TEMPORARY: container images are skipped, so the CLI release can ship.
+      #
+      # go-binary-release.yml's `goreleaser` job declares `permissions: contents:
+      # write` and nothing else, and once a permissions block exists everything
+      # unlisted is `none` -- so its GITHUB_TOKEN has `packages: none`. The
+      # called workflow's block is the authoritative one for its own jobs, so the
+      # `packages: write` this job declares below cannot widen it. The push then
+      # fails with
+      #
+      #   denied: installation not allowed to Write organization package
+      #
+      # after a full six-minute build. Granting the repo write access on the
+      # GHCR package does not help either: the token has no packages scope to
+      # exercise in the first place.
+      #
+      # `docker: false` alone would make it worse, not better -- that input only
+      # skips QEMU, Buildx and the registry *login*, while .goreleaser.yml still
+      # has dockers/docker_manifests, so GoReleaser would build the images and
+      # push them unauthenticated. The pipe has to be skipped in GoReleaser
+      # itself, and then the setup steps are simply unnecessary.
+      #
+      # Revert both lines once xraph/workflows grants `packages: write` and its
+      # v1 tag moves: https://github.com/xraph/workflows/pull/1
+      docker: false
       registry: ghcr.io
       goreleaser-version: '~> v2'
+      goreleaser-args: 'release --clean --skip=docker'
     secrets:
       GORELEASER_TOKEN: ${{ secrets.GORELEASER_TOKEN }}
       FURY_TOKEN: ${{ secrets.FURY_TOKEN }}