close
Skip to content

fix(ci): pass App token via 'token' input to action-gh-release#22

Merged
Fahl-Design merged 1 commit into
mainfrom
fix/release-upload-token
May 6, 2026
Merged

fix(ci): pass App token via 'token' input to action-gh-release#22
Fahl-Design merged 1 commit into
mainfrom
fix/release-upload-token

Conversation

@Fahl-Design
Copy link
Copy Markdown
Member

Summary

  • Toolchain pin from fix(ci): pin build matrix toolchain to 1.95.0 #21 worked: matrix builds compile. But asset upload still failed with Resource not accessible by integration (403). v1.1.1 release was published with zero binaries.
  • Root cause: softprops/action-gh-release@v2.6.1 (per fix: prefer token input over GITHUB_TOKEN softprops/action-gh-release#751) now prefers the explicit token: input over the GITHUB_TOKEN env var. Action default is token: ${{ github.token }} — the workflow GITHUB_TOKEN, not the GitHub App token we want. Build job has no permissions: block, so the workflow token has no release write perms.
  • Fix: pass the App token via token: input. Drop the now-redundant env: GITHUB_TOKEN.
  • Once merged, semantic-release cuts v1.1.2 with all three tarballs and install.sh recovers automatically.

Test plan

  • CI Lint & Test passes
  • On merge: semantic-release publishes v1.1.2
  • All three matrix Build jobs succeed and upload assets
  • v1.1.2 release contains pvm-linux-x86_64.tar.gz, pvm-macos-aarch64.tar.gz, pvm-macos-x86_64.tar.gz
  • curl -fsSL https://raw.githubusercontent.com/WebProject-xyz/php-version-manager/main/install.sh | bash succeeds on macOS aarch64 (issue Cannot install on MacOs #20 reproducer)

Refs #20

softprops/action-gh-release v2.6.1 (PR softprops/action-gh-release#751)
prefers the explicit 'token' input over the GITHUB_TOKEN env var. The
action.yml default for 'token' is the workflow-scoped GITHUB_TOKEN
(${{ github.token }}), not the GitHub App token we intend to use. The
build job has no permissions: block, so the workflow GITHUB_TOKEN
cannot update releases, producing 'Resource not accessible by
integration' (403) when uploading assets to the release that
semantic-release just created. v1.1.1 was published with no binaries
for this reason.

Pass the GitHub App token as the 'token' input directly. Drop the
redundant env: GITHUB_TOKEN since the action no longer reads it when
the token input is set.

Refs #20
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 6, 2026

Warning

Rate limit exceeded

@Fahl-Design has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 33 minutes and 53 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9204c3fe-f5c8-4218-bc64-3ec7b300d5c3

📥 Commits

Reviewing files that changed from the base of the PR and between d395430 and af237bf.

📒 Files selected for processing (1)
  • .github/workflows/release.yml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/release-upload-token

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@Fahl-Design Fahl-Design enabled auto-merge (squash) May 6, 2026 18:02
@Fahl-Design Fahl-Design merged commit abeeac3 into main May 6, 2026
3 of 4 checks passed
@Fahl-Design Fahl-Design deleted the fix/release-upload-token branch May 6, 2026 18:03
webproject-bot Bot pushed a commit that referenced this pull request May 6, 2026
## [1.1.2](v1.1.1...v1.1.2) (2026-05-06)

### Bug Fixes

* **ci:** pass App token via 'token' input to action-gh-release ([#22](#22)) ([abeeac3](abeeac3)), closes [softprops/action-gh-release#751](softprops/action-gh-release#751) [#20](#20)
@webproject-bot
Copy link
Copy Markdown

webproject-bot Bot commented May 6, 2026

🎉 This PR is included in version 1.1.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant