Skip to content

ci: avoid duplicate release tag auth headers #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
haasonsaas merged 1 commit into from
Apr 20, 2026
Merged

ci: avoid duplicate release tag auth headers #136

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ jobs:
uses: actions/checkout@v6
with:
fetch-depth: 0
persist-credentials: false
Copy link
Copy Markdown

@cursor cursor Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tag fetch runs before git auth is configured

Medium Severity

The git fetch --force --tags origin step on line 26 runs before setup-go-service (line 29) configures git authentication. With the newly added persist-credentials: false, checkout no longer leaves credentials in the git config. The setup-go-service composite action is what configures the extraheader auth (via git config --global), but it runs two steps later. For a private repository, this fetch will fail with an authentication error. Even for a public repo this creates a fragile ordering dependency.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e2c22b6. Configure here.


- name: Fetch tags
run: git fetch --force --tags origin
Expand Down