Repository navigation
ci: pass the workflow token to go-tools downloads - #54
Merged
Merged
Conversation
go-tools 1c70756 made taskgate check that every workflow step names a task the Taskfile has, by running `task --list-all`; Task is a go.mod tool here, not on PATH, so the gate failed with 'exec: "task": executable file not found'. -task {{.TASK_EXE}} hands it the Task already running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
go-tools 2b473b1 (spin-stack/go-tools#89): with GITHUB_TOKEN or GH_TOKEN set, a GitHub release download goes through the API, where a token counts, instead of anonymously; the token goes to api.github.com and nowhere else, and an error names the host that answered. GitHub's status page on 2026-11-08 and -09 names the 504s that failed CI: increased timeouts due to a surge in anonymous users. The workflows that run the tools now set GITHUB_TOKEN to the workflow's own token at workflow level. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
go-tools 2b473b1 (spin-stack/go-tools#89): with GITHUB_TOKEN or GH_TOKEN set, a GitHub release download goes through the API, where a token counts, instead of anonymously; the token goes to api.github.com and nowhere else, and an error names the host that answered. GitHub's status page on 2026-11-08 and -09 names the 504s that failed CI: increased timeouts due to a surge in anonymous users. The workflows that run the tools now set GITHUB_TOKEN to the workflow's own token at workflow level.
Decision to confirm: workflows whose token can write are left without it in every step's environment: release.yml (contents: write). Their downloads stay anonymous (still retried). Adding it there exposes a write token to every step, including package installs.
Supersedes #53: carries its taskgate fix (
-task {{.TASK_EXE}}) and bumps go-tools past it.🤖 Generated with Claude Code