Release workflow: push with a RELEASE_TOKEN from the Gitea bot (main is protected) #41

New Issue

2026-10-22T22:42:27Z

haylan commented

2026-10-22 22:42:27 +00:00

Problem

The Create Release Tag workflow (release.yml) fails when it pushes the release commit to main. Example: run 3311 / job 5817, releasing 0.2.2:

remote: error: Not allowed to push to protected branch main
 ! [remote rejected] HEAD -> main (pre-receive hook declined)

Checkout uses the built-in secrets.GITHUB_TOKEN, and branch protection on main rejects pushes made with it. Because the step runs with bash -e, the tag push never happens either. Nothing partial reached the server, so the release can be re-run once this is fixed.

Tasks

Create a personal access token for the Gitea bot account (the bot is allowed to bypass branch protection on main). Scope: write:repository.
Add it as a repository secret named RELEASE_TOKEN (Repository → Settings → Secrets → Actions).

In .gitea/workflows/release.yml, change the checkout step to use the new secret:

- name: Checkout
  uses: actions/checkout@v4
  with:
    fetch-depth: 0
    token: ${{ secrets.RELEASE_TOKEN }}

Optional: set the commit user.name / user.email in the "Commit and tag" step to match the bot account.
Re-run the release workflow for 0.2.2 and check that both the commit on main and the tag are pushed.

Generated by Claude Code with Claude Opus 5.5

## Problem The **Create Release Tag** workflow ([release.yml](https://git.arthurerlich.de/haylan/git-contribution-graph/src/branch/main/.gitea/workflows/release.yml)) fails when it pushes the release commit to `main`. Example: run 3311 / job 5817, releasing `0.2.2`: ``` remote: error: Not allowed to push to protected branch main ! [remote rejected] HEAD -> main (pre-receive hook declined) ``` Checkout uses the built-in `secrets.GITHUB_TOKEN`, and branch protection on `main` rejects pushes made with it. Because the step runs with `bash -e`, the tag push never happens either. Nothing partial reached the server, so the release can be re-run once this is fixed. ## Tasks - [x] Create a personal access token for the Gitea bot account (the bot is allowed to bypass branch protection on `main`). Scope: `write:repository`. - [x] Add it as a repository secret named `RELEASE_TOKEN` (Repository → Settings → Secrets → Actions). - [x] In `.gitea/workflows/release.yml`, change the checkout step to use the new secret: ```yaml - name: Checkout uses: actions/checkout@v4 with: fetch-depth: 0 token: ${{ secrets.RELEASE_TOKEN }} ``` - [x] Optional: set the commit `user.name` / `user.email` in the "Commit and tag" step to match the bot account. - [x] Re-run the release workflow for `0.2.2` and check that both the commit on `main` and the tag are pushed. --- Generated by Claude Code with Claude Opus 5.5

haylan referenced this issue from a commit

2026-10-23 21:01:36 +00:00

fix(ci): push release commit with RELEASE_TOKEN

haylan referenced a pull request that will close this issue

2026-10-23 21:01:36 +00:00

fix(ci): push release commit with RELEASE_TOKEN #42

haylan added reference fix/release-token

2026-10-23 21:15:48 +00:00

haylan closed this issue

2026-10-23 21:15:56 +00:00

Sign in to join this conversation.