Repository navigation
Let the release tagger push, and stop hiding git's reason - #266
Merged
Merged
Conversation
The first live run cut v0.0.0 correctly and died on the push with exit 128 and no
explanation. Two defects, one of which hid the other.
actions/checkout leaves an http.extraheader carrying GITHUB_TOKEN, and that header
wins over a token placed in the remote URL. This workflow declares permissions: {} on
purpose, so that token can do nothing. persist-credentials: false removes the header
and lets the MACHINE app token in the URL be the only credential.
CalledProcessError's message does not include stderr, so the one line of git output
naming the cause never reached the log; the failure was diagnosable only by reasoning
about the workflow. _git now raises with git's own words.
scheme/3 also records the commit and time it came into force, now that #257 has
merged. Neither field is a descriptive key, so the digest is unchanged and the records
already written under this scheme stay under it — which is the property those keys
were excluded from the digest to give.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #265
Goal
Let the release tagger push the tag it cuts, and report git's own error when it cannot.
Evidence
First live run, on the merge of #259:
actions/checkoutleaves anhttp.extraheadercarryingGITHUB_TOKEN; the workflowdeclares
permissions: {}on purpose, so that credential can do nothing, and it winsover the app token in the remote URL.
CalledProcessErrordoes not carry stderr, sogit's one-line reason never reached the log.
Scope — every changed path
.github/workflows/release-tag.yml—persist-credentials: falseon checkout.scripts/release_tag.py—_gitraises with git's stderr.docs/zendev/schemes.json—scheme/3recordsin_force_from2026-09-07T18:04:02Zand commit
39cca61d, the merge of Give the ACCEPTOR sole ownership of the verdict #257.Non-goals
Widening the job's permissions. It still declares
permissions: {}and acts onlythrough the MACHINE app token.
Acceptance criteria
v0.0.0and creates its release on a rerun.scheme/3's commit does not change its digest.Verification
Digest before and after the
schemes.jsonedit:f388453edf68both times — theproperty
in_force_fromandcommitwere excluded from the digest to provide.🤖 Generated with Claude Code