fix: create the release tag through the API, not git push - #54
Merged
Conversation
VirtualWindow's release failed at the tag push:
! [remote rejected] v1.1.0 (refusing to allow a GitHub App to create or
update workflow `.github/workflows/ggshield.yml` without `workflows`
permission)
The tag lands on the commit the image came from, and a later commit had changed
that repo's ggshield workflow — so the pushed ref carried a workflow file
differing from the default branch, which a token-authenticated push is not
allowed to do. GITHUB_TOKEN cannot hold the `workflows` scope at all, so no
permissions change fixes it.
Topology and Atlas escaped this only by accident: their tagged commits happened
to have workflow files identical to main's. Any repo where CI changed after the
last image build would have hit it.
The git-data API creates a tag object pointing at an existing commit and
introduces no file changes, so the restriction does not apply. Still annotated,
same message.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fourth finding from real use, and the first that would have bitten every repo eventually rather than one.
What failed
VirtualWindow's release promoted both images correctly, then died pushing the tag:
The tag lands on the commit the image came from — by design, so a version names code that is actually in it. That commit predates the repo's ggshield pin, so the ref being pushed carries a workflow file that differs from the default branch's, and a token-authenticated push is not allowed to do that.
No permissions change fixes it:
workflowsis a PAT scope, not somethingGITHUB_TOKENcan be granted.Why it looked fine twice
Topology and Atlas escaped by accident — their tagged commits happened to carry workflow files identical to
main's at push time. Any repo whose CI changed after its last image build would have hit this, so the two green releases were luck, not evidence.The fix
Create the tag through the git-data API: a tag object pointing at an existing commit introduces no file changes, so the workflow-file restriction does not apply. Still annotated, same message, same commit.
Also removes the last reason this job needed write access to the checkout.