ci: fix APT publish failure and bump actions to latest majors - #252
Merged
Conversation
The 2.1.6 release failed in "Publish to APT": the step installed rclone without refreshing the package index first, so apt resolved the version baked into the runner image (1.60.1+dfsg-3ubuntu0.24.04.5), which Ubuntu has since removed from the pool. The download 404'd and the step exited 100, which also skipped the Homebrew formula update. Add apt-get update before the install. Also bump the actions that were being force-migrated off Node 20: actions/checkout v4 -> v7 actions/setup-go v5 -> v7 actions/upload-artifact v4 -> v7 actions/create-github-app-token v1 -> v3 checkout v6 moved persisted credentials out of .git/config into a separate file referenced by includeIf, so the release job's "git config --unset-all http.https://github.com/.extraheader" no longer removes them and the GITHUB_TOKEN header would have overridden the GitHub App token in the formula push remote URL. Check out with persist-credentials: false instead, which leaves no header to unset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jakobkollerup
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The 2.1.6 release run failed in Publish to APT:
The step ran
apt-get install rclonewith noapt-get update, so apt asked the mirror for thercloneversion baked into the runner image. Ubuntu has since published a newer one and dropped that.debfrom the pool → 404 → exit 100.dpkg-devandapt-utilswere already present; onlyrcloneneeded downloading.Fallout: the GitHub Release for 2.1.6 was created, but the APT repo never got 2.1.6 and the two Homebrew steps after it were skipped, so the formula wasn't bumped either.
What
apt-get updatebefore the install in the APT publish step.Bump the actions that GitHub was force-migrating off Node 20 (the
release: .github#2annotation on that run):actions/checkoutactions/setup-goactions/upload-artifactactions/create-github-app-tokengolangci/golangci-lint-actionwas already on the current major (v9).One non-obvious interaction
checkoutv6 moved persisted credentials out of.git/configinto a separate file wired up viaincludeIf.gitdir:<gitdir>.path. The release job's formula push relied ongit config --unset-all http.https://github.com/.extraheaderto drop theGITHUB_TOKENheader before pointingoriginat a URL carrying the GitHub App token — under v6+ that unset is a no-op (it's guarded by|| true, so it fails silently) and theGITHUB_TOKENAuthorizationheader would win over the app token in the remote URL, pushing tomainas the wrong identity.Fixed at the source instead: the release job checks out with
persist-credentials: false, so there is no header to unset, and the now-dead--unset-allline is removed. Nothing else in that job needs persisted git credentials —gh release createauthenticates viaGH_TOKEN.Reviewer checks
Verified against upstream release notes:
setup-gov6's toolchain handling change is low risk here sincego.modpinsgo 1.25.0with notoolchaindirective;create-github-app-tokenv2 dropped the underscore-style inputs but this workflow already usedapp-id/private-key; v3's only breaking change is proxy-related.upload-artifactv7's newarchiveinput is opt-in.Recovery for 2.1.6
Re-running the failed job won't help — a tag-triggered run uses the workflow file from the tagged tree, which won't contain this fix. After merge, either move the tag (
git tag -f 2.1.6 && git push -f origin 2.1.6) or cut 2.1.7. The latter is cleaner given a 2.1.6 GitHub Release already exists.🤖 Generated with Claude Code