From 7e59978f078c07742baa0311daff711c929bda68 Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Thu, 15 Oct 2026 08:00:51 +0200 Subject: [PATCH] ci: fetch the release tag with basic auth GitHub's git endpoint rejects a bearer header; it takes the job token as the password of x-access-token, as actions/checkout does. The release tag is also resolved in the job environment. --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f46fd46..bce94a1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,8 @@ jobs: run: | case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac git init -q . - git -c http.extraheader="AUTHORIZATION: bearer $GITHUB_TOKEN" fetch -q --depth 1 \ + basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0) + git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \ "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF" git checkout -q "refs/tags/$RELEASE_REF" - name: Install Node