The publishing step needs the secret after all
A manual build printed a forge credential, so the last change dropped the secret and relied on it. The first tag build then built all four packages and died at the publishing step with no credential at all: a build started by the tag webhook does not get one. So `gitea_token` is a repository secret again, mapped into the step, with the forge credential kept as a fallback for the manual case. The README and the wiki now describe what was measured rather than what the manual build suggested. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
+1
-2
@@ -62,8 +62,7 @@ A `vX.Y.Z` tag now starts the pipeline, which builds the AppImage, the deb, the
|
||||
installer and the portable exe — Windows through Wine — **creates this release** and
|
||||
attaches all four. macOS stays a local build, because Apple's toolchain and its signing
|
||||
exist only on a Mac, so `make release` from a Mac pushes that package onto the same
|
||||
release afterwards. No secret is involved: the pipeline publishes with the forge
|
||||
credential Woodpecker already gives every step.
|
||||
release afterwards. Publishing uses a `gitea_token` repository secret in Woodpecker.
|
||||
|
||||
The Windows installer is not signed: Windows will warn about an unknown publisher until
|
||||
there is a certificate.
|
||||
|
||||
Reference in New Issue
Block a user