fix(#868k5bbdr): Fail publish loudly when FURY_PUSH_TOKEN is missing#8
Merged
Conversation
The previous curl invocation exited 0 on 4xx responses from Gemfury, so publish runs reported success even when the secret was empty (empty interpolation produced URL 'https://@push.fury.io/mapped/', which fury answered with 'unauthorized'). Changes: - Move FURY_PUSH_TOKEN into a step env var (empty-secret check works) - Preflight check with actionable ::error:: annotation - curl --fail-with-body so 401/403/etc. fail the step - Loop the two artifacts for clarity
loopingrage
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The publish workflow has been silently reporting success while never actually uploading anything to fury. The last three publish runs on
masterall say "success" but the run logs show:Root cause:
mapped/betterprotoisn't on theFURY_PUSH_TOKENorg secret's repo allow-list, so${{ secrets.FURY_PUSH_TOKEN }}renders as the empty string. The upload URL becomeshttps://@push.fury.io/mapped/, Gemfury answersunauthorized, andcurlexits 0 because it doesn't treat 4xx as an error by default.Fix
env:so we can[ -z ... ]check it and abort with an actionable error before running curl.curl --fail-with-bodyso 401/403/etc. actually fail the step (and print the body).Follow-up needed (outside this PR)
One of:
mapped/betterprototo theFURY_PUSH_TOKEN(and ideallyFURY_READ_TOKEN) org secret's selected-repositories list; orgh secret set FURY_PUSH_TOKEN --repo mapped/betterproto.Once done, an empty commit on master (or re-running the workflow) will publish
betterproto-1.0.1to https://pypi.fury.io/mapped/.