This is an automated email from the ASF dual-hosted git repository.
HyukjinKwon pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark-connect-rust.git
The following commit(s) were added to refs/heads/master by this push:
new f7aaed0 [SPARK-59106] Use RELEASE_GITHUB_TOKEN for the release-tag
pushes to apache
f7aaed0 is described below
commit f7aaed09ad424c962dcbab0f808921acc74acdd4
Author: Hyukjin Kwon <[email protected]>
AuthorDate: Sat Aug 29 17:51:53 2026 +0900
[SPARK-59106] Use RELEASE_GITHUB_TOKEN for the release-tag pushes to apache
### What changes were proposed in this pull request?
Set `persist-credentials: false` on the `publish-rc` and `finalize`
checkouts in the release workflow.
### Why are the changes needed?
Cutting an RC failed at "Create and push the RC tag to the canonical apache
repo":
```
remote: Permission to apache/spark-connect-rust.git denied to
github-actions[bot].
fatal: ... The requested URL returned error: 403
```
`RELEASE_GITHUB_TOKEN` is configured, so the secret isn't the problem — the
push went out as `github-actions[bot]` rather than the PAT identity. Both jobs
check out `apache/spark-connect-rust` with `actions/checkoutv4` at its default
`persist-credentials: true`, which stores the **built-in** `GITHUB_TOKEN` as a
git `http.https://github.com/.extraheader`. That header overrides the
`RELEASE_GITHUB_TOKEN` embedded in the subsequent
```
git push
https://x-access-token:${RELEASE_GITHUB_TOKEN}github.com/apache/spark-connect-rust.git
refs/tags/<tag>
```
so the push authenticates as `github-actions[bot]` (which cannot write to
apache) → 403. The `gh`-CLI release steps use the PAT via `GH_TOKEN` and were
unaffected; only the two `git push` steps were hijacked.
With `persist-credentials: false` no interfering `extraheader` is written,
so the PAT-in-URL pushes authenticate as the token owner. No new secret is
required.
### Does this PR introduce _any_ user-facing change?
No — release tooling only.
### How was this patch tested?
`actionlint` passes. The checkouts are of the public apache repo, so
`persist-credentials: false` does not affect the read (checkout/artifacts);
only the PAT-authenticated `git push` steps change identity.
This pull request and its description were written by Isaac.
Closes #88 from HyukjinKwon/fix-release-token-push.
Authored-by: Hyukjin Kwon <[email protected]>
Signed-off-by: Hyukjin Kwon <[email protected]>
---
.github/workflows/release.yml | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ffe851f..90c6f3e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -366,6 +366,10 @@ jobs:
repository: ${{ env.UPSTREAM_REPO }}
ref: ${{ needs.resolve.outputs.sha }}
fetch-depth: 0 # full history so the tag push carries all reachable
objects
+ # Do NOT persist the built-in GITHUB_TOKEN as an http.extraheader:
it would
+ # override the RELEASE_GITHUB_TOKEN embedded in the push URL below,
so the push
+ # to apache would go out as github-actions[bot] (which cannot write
to apache).
+ persist-credentials: false
- uses: actions/download-artifact@v4
with:
pattern: wheels-*
@@ -443,6 +447,9 @@ jobs:
repository: ${{ env.UPSTREAM_REPO }}
ref: ${{ needs.resolve.outputs.rc_tag }}
fetch-depth: 0
+ # Same reason as publish-rc: don't let the built-in token's persisted
+ # http.extraheader override RELEASE_GITHUB_TOKEN on the release-tag
push below.
+ persist-credentials: false
- name: Validate the RC source versions
run: |
set -euo pipefail
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
