From 0cf44e1dfa7266cc6ba1d4e97eb32a37c3f90f86 Mon Sep 17 00:00:00 2001 From: mixeme Date: Mon, 27 Jul 2026 22:17:34 +0300 Subject: [PATCH] docs: spell out what a missing RELEASE_TOKEN actually does MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The note said Codeberg needs the secret but not what happens without it, so the failure mode had to be inferred from a red job. Record it: build and packaging still succeed, the upload step fails on authentication and takes the job with it, and the release is published with no assets. Not "the upload step is skipped", which is what the comment in .forgejo/workflows/release.yml claims. That step is guarded only by `if: github.event_name == 'release'` — there is no token check and no continue-on-error, so an absent or unscoped token makes it fail rather than skip. Skipping is the workflow_dispatch path. The workflow comment is still wrong and is left for a separate change. Also name why GitHub needs no setup: softprops/action-gh-release falls back to the built-in GITHUB_TOKEN and the workflow grants contents:write. Co-Authored-By: Claude Opus 5 --- docs/DEVELOPMENT.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 3c29c4d..e6ac54d 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -292,4 +292,8 @@ also allows a manual, upload-free build to smoke-test the pipeline. Codeberg publishing needs a repository secret named `RELEASE_TOKEN` (a Codeberg access token with the `write:repository` scope) under -**Settings → Actions → Secrets**. GitHub uses the built-in `GITHUB_TOKEN`. +**Settings → Actions → Secrets**. Without it the build and packaging steps still +succeed, but the upload step fails on authentication and takes the job down with +it, leaving a published release with no attached assets. GitHub needs no such +setup: `softprops/action-gh-release` falls back to the built-in `GITHUB_TOKEN`, +and the workflow already grants it `contents: write`.