PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

KAN-58: Fix macOS release token permissions #154

Merged
Twyco merged 1 commits from fix/KAN-58-release-token-permissions into main 2026-09-27 09:17:13 +00:00
Conversation 0 Commits 1 Files Changed 2
+154 -18
Twyco commented 2026-09-27 09:13:30 +00:00
Owner
Copy Link
Copy Source

The macOS release stops with HTTP 403 before building because Gitea 1.27.2 requires repository administrator rights even to read /tag_protections. Remove that redundant runtime lookup: Gitea already enforces the configured macos-v* protection when tags are created or changed. The job token stays read-only; release tag syntax, main ancestry and app-version validation remain in place.

Validation: 107 native JavaScript tests pass, including nine tests exercising the actual release-ref shell step against local Git repositories (valid tag, manual dispatch, invalid/missing tags, malformed runner labels and unmerged commits). ESLint, workflow YAML/shell syntax and diff checks pass. The live macos-v* protection was verified separately and is unchanged.

After merge, start a new manual macOS release to Hetzner run on main with tag=macos-v0.1.0. Retrying run 1320 would use its old workflow definition. The existing tag does not need to move. The actual signed S3 release and user installation check remain pending, so KAN-58 stays In Progress.

Ticket: https://kanbangit.de/projects/1/tickets/58
Base: main, pulled with --ff-only at 1c620654a33a9b31cd149439ed1d2eb6c81011dc before creating fix/KAN-58-release-token-permissions.

The macOS release stops with HTTP 403 before building because Gitea 1.27.2 requires repository administrator rights even to read `/tag_protections`. Remove that redundant runtime lookup: Gitea already enforces the configured `macos-v*` protection when tags are created or changed. The job token stays read-only; release tag syntax, main ancestry and app-version validation remain in place. Validation: 107 native JavaScript tests pass, including nine tests exercising the actual release-ref shell step against local Git repositories (valid tag, manual dispatch, invalid/missing tags, malformed runner labels and unmerged commits). ESLint, workflow YAML/shell syntax and diff checks pass. The live `macos-v*` protection was verified separately and is unchanged. After merge, start a new manual `macOS release to Hetzner` run on `main` with `tag=macos-v0.1.0`. Retrying run 1320 would use its old workflow definition. The existing tag does not need to move. The actual signed S3 release and user installation check remain pending, so KAN-58 stays In Progress. Ticket: https://kanbangit.de/projects/1/tickets/58 Base: `main`, pulled with `--ff-only` at `1c620654a33a9b31cd149439ed1d2eb6c81011dc` before creating `fix/KAN-58-release-token-permissions`.
Twyco added 1 commit 2026-09-27 09:13:30 +00:00
fix(KAN-58): avoid admin API in macOS release workflow
CI/CD / preconditions (pull_request) Successful in 1s
Details
Native JavaScript checks / Native launcher and release tests (pull_request) Successful in 58s
Details
macOS checks / Native Rust tests and unsigned build (pull_request) Successful in 3m22s
Details
CI/CD / Publish immutable image (pull_request) Canceled after 0s
Details
CI/CD / test_and_check_app (pull_request) Canceled after 4m18s
Details
f52cffeaeb
Twyco merged commit b4cd6a5808 into main 2026-09-27 09:17:12 +00:00
Twyco deleted branch fix/KAN-58-release-token-permissions 2026-09-27 09:17:13 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Eric Twyco flux-image-automation (Flux Image Automation)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: PetschStudios/KanbanGit#154