Does semantic-release support fine-grained personal access token?

[roancoetzee]

We are looking to move over the Github's fine-grained PAT and away from personal access token(classic). We have done an initial test run on one of our repo and gave the fine grained token read and write access to all permission to ensure we didnt make a mistake by giving it the incorrect permission.

When we swapped the PAT(classic) for the Fine-grained PAT we get the following error:

An error occurred while running semantic-release: Error: Command failed with exit code 128: git ls-remote --heads https://[secure]@github.com/repo/path
remote: Support for password authentication was removed on August 13, 2021

Before we go chasing our tails we just want to double check if semantic-release supports fine-grained PATs.

[travi]

as long as the proper permissions are applied for the token, there should be nothing preventing the use for fine-grained PATs

[roancoetzee]

I played around with this a bit more since your response.

I've created a fine-grained PAT with all the possible permissions.
Running the command git ls-remote --heads https://[classic-PAT]@github.com/repo/path works as expected.
Running git ls-remote --heads https://[fine-grained-PAT]@github.com/repo/path does not in that it then asks you for a password which then turns into the error message in my original post.

I might be a bit naive here in expecting the tokens to work when used in the same way so I did some googling and came across this post that indicate the url is slightly different for fine-grained PATs.

Changing the url to now include oauth2 combined with a fine-grained PAT it works as expected.
git ls-remote --heads https://oauth2:[fine-grained-PAT]@github.com/repo/path

Correct me if I'm wrong but semantic-release is responsible for constructing that url right? If not is there a way I can?

[roancoetzee]

@travi Any addtional thoughts.

[travi]

apologies for not following up sooner. based on your investigation, it does look like we have some work to do on our side to leverage those tokens. if you'd like to investigate what it would take, please feel free to start a PR and we could discuss further there.

short of that, i think i have to recommend using normal tokens for the time being.