Skip to content

fix(ci): executable gradlew, and tag.yml token/permissions #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stozo04 merged 2 commits into from
Sep 7, 2026
Merged

fix(ci): executable gradlew, and tag.yml token/permissions #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec423ea
fix(release): set the executable bit on gradlew before building
stozo04 Sep 7, 2026
6d472bc
fix(tag): fall back to GITHUB_TOKEN and request contents write
stozo04 Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
run: |
if [[ -z "$RELEASE_TOKEN" ]]; then
echo "::error::RELEASE_TOKEN is not set. A real release run pushes the bump branch and merges its own PR, which needs a fine-grained PAT with contents and pull-requests write. Add it as a repository secret, or re-run with dry_run to build only."
echo "::error::RELEASE_TOKEN is not set. A real release run pushes the bump branch and merges its own PR, which needs a credential that can bypass the ruleset — a fine-grained PAT, or a GitHub App token. Add it as a repository secret, or re-run with dry_run to build only."
exit 1
fi
echo "RELEASE_TOKEN is present."
Expand Down Expand Up @@ -195,7 +195,12 @@ jobs:
echo "Keystore opens and contains the alias."

- name: Build the release bundle
run: ./gradlew :app:bundleRelease --no-daemon --stacktrace
run: |
set -euo pipefail
# gradlew is mode 100644 in the index — git on Windows does not track the executable
# bit, so a Linux runner checks it out non-executable. Set it here rather than assuming.
chmod +x gradlew
./gradlew :app:bundleRelease --no-daemon --stacktrace

- name: Verify the signature
id: sign
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,10 @@ on:
type: boolean
default: false

# Creating a tag and a GitHub release is a write. Tags are not covered by the branch ruleset, so
# the job's own GITHUB_TOKEN is enough here — no PAT or App token needed for run 2.
permissions:
contents: read
contents: write

concurrency:
group: openloop-release
Expand All @@ -46,15 +48,15 @@ jobs:
name: Cut tag and GitHub release
runs-on: ubuntu-latest
env:
GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}

@cursor cursor Bot Sep 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing actions permission for artifact download

High Severity

The job now falls back to github.token with only contents: write, so actions is none. gh run download of another run’s artifacts needs actions: read. When RELEASE_TOKEN is unset, fetch fails with 403 and the tag is never cut.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 6d472bc. Configure here.


steps:
- name: Checkout
uses: actions/checkout@v6
with:
ref: main
fetch-depth: 0
token: ${{ secrets.RELEASE_TOKEN }}
token: ${{ secrets.RELEASE_TOKEN || github.token }}

# tag-release.ps1 warns when releases/openloop-<version>-<code>.aab is missing. In CI it
# always would be, which turns a real safety check into noise — so pull the artifact the
Expand Down