Why release.gitlab requires api scope token?

[mishak87]

GitLab CI_JOB_TOKEN is allowed to create a release. What other API calls goreleaser is using that require api scope?
https://docs.gitlab.com/ee/api/README.html#gitlab-cicd-job-token

[mavogel]

You might want to take a look here https://github.com/goreleaser/goreleaser/blob/master/internal/client/gitlab.go

[mishak87]

I assumed it only creates the release without detection/update logic. Would it be possible when #2006 is implemented to have option of create-only release?
My use-case is run goreleaser and create gitlab release. I am ok with updating/deleting bad releases manually if that is what it takes to not have "root" token in my pipeline.
Especially since https://gitlab.com/groups/gitlab-org/-/epics/3559 can take years to complete.

[mavogel]

TBH I do the same if a release failed or is incomplete. Initially we kept the gitlab release close the the Github one, which had the update possibility of a release in place. From my point of view we could move to create-only. @caarlos0 WDYT?

[caarlos0]

@mavogel I think it makes sense yes...