fix(release): authenticate git before the guard steps - #20
Merged
Merged
Conversation
Consumers check out with persist-credentials: false, so the clone has no
credentials and the guards' git fetch / ls-remote fail on a private repo
('could not read Username'). release-candidate never configured auth;
settle and publish configured it only after their guard. Every action now
sets the app-token extraheader as its first step (dropping any header a
persisted checkout left, since git sends all of them) and removes it in an
always() step; candidate drops it before create-pull-request, which
authenticates its own push.
Also push the generated settle/changelog branches with --force rather than
--force-with-lease: there is no remote-tracking ref for them on a re-run,
so the lease would reject the exact case it is meant to allow.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013eLFMaDpEwgDzyDBzCQzLH
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013eLFMaDpEwgDzyDBzCQzLH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First pilot dispatch on mega-agents (run 34103464078) failed in
release-candidate's guard:fatal: could not read Username for 'https://github.com'. Consumers check out withpersist-credentials: false(as the templates say), so the clone has no credentials andgit fetch --tags/git ls-remotefail on a private repo.release-candidatenever configured git auth;release-settleandrelease-publishconfigured it only after their guard step, which also fetches.extraheaderas their first step — unsetting any header a persisted checkout left, since git sends every configured one — and remove it in anif: always()step.release-candidatedrops the header beforecreate-pull-request, which authenticates its own push with the token input.chore/release-settle-*/chore/changelog-*branches are pushed with--forceinstead of--force-with-lease: on a re-run there is no remote-tracking ref for them, so the lease rejects exactly the case it should allow.Validated: YAML parses, shellcheck clean, unit tests pass. Consumers track
@main, so no caller change is needed; the pilot re-dispatches after merge.🤖 Generated with Claude Code