ci: fetch the release tag with basic auth

GitHub's git endpoint rejects a bearer header; it takes the job token as the password of x-access-token, as actions/checkout does. The release tag is also resolved in the job environment.
ci: resolve the release tag in the job environment
2026-10-15 08:00:51 +02:00 · 2026-10-15 07:59:08 +02:00
1 changed files with 5 additions and 5 deletions
@@ -18,13 +18,12 @@ on:
 permissions:
  contents: write

-env:
-  NODE_VERSION: v24.12.0
-  RELEASE_REF: ${{ inputs.tag || github.ref_name }}
-
 jobs:
  release:
    runs-on: ubuntu-latest
+    env:
+      NODE_VERSION: v24.12.0
+      RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
    steps:
      - name: Check out the tag
        env:
@@ -32,7 +31,8 @@ jobs:
        run: |
          case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
          git init -q .
-          git -c http.extraheader="AUTHORIZATION: bearer $GITHUB_TOKEN" fetch -q --depth 1 \
+          basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
+          git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \
            "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
          git checkout -q "refs/tags/$RELEASE_REF"
      - name: Install Node
Author	SHA1	Message	Date
marc	7e59978f07	ci: fetch the release tag with basic auth GitHub's git endpoint rejects a bearer header; it takes the job token as the password of x-access-token, as actions/checkout does. The release tag is also resolved in the job environment.	2026-10-15 08:00:51 +02:00
marc	4ffd755fe7	ci: resolve the release tag in the job environment	2026-10-15 07:59:08 +02:00