mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
812a8c7ccb
* fix(release): use the job token for the publish checkout (#15727) The publish checkout only reads the release SHA and disables persisted credentials, so the bot PAT it asked for was never used. Gating a read-only checkout on that secret turns any checkout-time auth failure into a failed release before any work runs; the push step already re-authenticates with the PAT it needs. * fix(release): probe the bot PAT on dry runs (#15727) The publish checkout no longer touches the bot PAT, so a dry-run rehearsal stopped exercising the credential and a rotated PAT surfaced only on the next live release. Probe it in a dry-run-only, non-blocking step placed after the push step, where the live path legitimately holds it. Widen the package-scripts pin so it catches any secret on the read-only checkout and any CI_BOT_PAT consumer before the push step, not just the exact step name and secret spelling. Bump release.yml's size baseline for the added step. * fix(release): check the bot PAT's push capability on dry runs (#15727) * fix(release): drop the ineffective dry-run PAT probe (#15727) The probe only ran on dry runs, where no release step consumes the bot PAT, and its `|| echo` turned every failure into a green warning. Make the publish checkout's job token explicit instead, and keep the pins that no secret or bot PAT reaches it before the push step. * test(release): pin the bot PAT out of the publish checkout (#15727) The PR's Reviewer Test Plan names expect(checkoutStep).not.toContain('CI_BOT_PAT'), but neither test file contained it. Add the assertion before the job-token pin so the documented mutation fails on exactly the named assertion. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: 易良 <[email protected]>