mirror of
https://github.com/lukaszraczylo/shared-actions.git
synced 2026-10-12 04:54:48 +00:00
lukaszraczylo
9533a6518f
A caller can grant narrower permissions than the release job needs. The release then fails at the end, when it creates the tag or pushes an image. The preflight job now declares the same contents and packages permissions as the release job and probes with the real token. A git push dry run checks that the token can create the tag and release. A ghcr.io token request and a blob upload session check that the token can push the image. The upload session creates no package. The release-cgo workflow probes ghcr only when the GoReleaser config builds ghcr.io images. The release workflow probes it when docker-enabled is true and the registry is ghcr.io. A probe that cannot reach a verdict warns and does not fail.