From 47cd914dc93eb16e28f8959b4dcabbc318a4d63c Mon Sep 17 00:00:00 2001 From: Peer Sommerlund Date: Sun, 25 Oct 2026 22:32:47 +0100 Subject: [PATCH 1/5] Give release workflow permission to write binaries --- .github/workflows/release.yml | 5 +++++ CHANGELOG.md | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b53c07..264535e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,11 @@ jobs: release: name: Release for ${{ matrix.os }} runs-on: ${{ matrix.os }} + + # Explicitly grant GITHUB_TOKEN write access to attach binaries to the release + permissions: + contents: write + strategy: matrix: include: diff --git a/CHANGELOG.md b/CHANGELOG.md index 6a00979..94dc76f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [unreleased] - Next Date +### Changed + +- Grant github release workflow permission to write binaries + ## [0.8.1] - 2026-10-25 From e3431ee9e6729553879281554a98406df3cf9bf1 Mon Sep 17 00:00:00 2001 From: Peer Sommerlund Date: Sun, 25 Oct 2026 22:56:29 +0100 Subject: [PATCH 2/5] Prevent upload skips for a draft release github.ref might refer to the default branch instead of the tag if the draft was created before the tag was pushed. --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 264535e..e5dfbfd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -69,4 +69,5 @@ jobs: repo_token: ${{ secrets.GITHUB_TOKEN }} file: release.tar.gz asset_name: ${{ env.REPO }}-${{ env.RELEASE_VERSION }}-${{ matrix.os_name }}.tar.gz - tag: ${{ github.ref }} + tag: ${{ github.event.release.tag_name }} + overwrite: true From 703e65a208ffd30facbd0ec876d0cbec1bfaaec4 Mon Sep 17 00:00:00 2001 From: Peer Sommerlund Date: Sun, 25 Oct 2026 23:01:22 +0100 Subject: [PATCH 3/5] Enable release testing By building binaries when a release is created, it is now possible to test a release build before publishing it. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e5dfbfd..ca335a0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,7 +2,7 @@ name: Release on: release: - types: [published] + types: [created, published] push: branches: [master] pull_request: From 53978f3b116e72f530fafef763e90a1ca3958af8 Mon Sep 17 00:00:00 2001 From: Peer Sommerlund Date: Sun, 25 Oct 2026 23:16:56 +0100 Subject: [PATCH 4/5] Upgrade actions/checkout to match node.js version v4 uses node.js v20, so use a more recent version that is designed for node.js v24 --- .github/workflows/crates-io.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/tests.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/crates-io.yml b/.github/workflows/crates-io.yml index 5fcebf7..34b4b8f 100644 --- a/.github/workflows/crates-io.yml +++ b/.github/workflows/crates-io.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install Rust uses: dtolnay/rust-toolchain@stable - name: Publish binaries diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ca335a0..ec36170 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,7 +34,7 @@ jobs: os_name: "macos-amd64" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Get tag or commit run: | diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ad86a6b..5866ee2 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout sources - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install stable toolchain uses: dtolnay/rust-toolchain@stable @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout sources - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install stable toolchain uses: dtolnay/rust-toolchain@stable From cc0e89231d21fe5c5edf396031fffe68f8840d65 Mon Sep 17 00:00:00 2001 From: Peer Sommerlund Date: Sun, 25 Oct 2026 23:37:33 +0100 Subject: [PATCH 5/5] Handle release events For release events there will not be a refs/tags/ They currently use the SHA as version number. --- .github/workflows/release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ec36170..312007a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,7 +38,9 @@ jobs: - name: Get tag or commit run: | - if [[ "${GITHUB_REF}" == refs/tags/* ]]; then + if [ "${{ github.event_name }}" = "release" ]; then + echo "RELEASE_VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV + elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV else SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)