HyukjinKwon opened a new pull request, #88: URL: https://github.com/apache/spark-connect-rust/pull/88
### What changes were proposed in this pull request? Set `persist-credentials: false` on the `publish-rc` and `finalize` checkouts in the release workflow. ### Why are the changes needed? Cutting an RC failed at "Create and push the RC tag to the canonical apache repo": ``` remote: Permission to apache/spark-connect-rust.git denied to github-actions[bot]. fatal: ... The requested URL returned error: 403 ``` `RELEASE_GITHUB_TOKEN` is configured, so the secret isn't the problem — the push went out as `github-actions[bot]` rather than the PAT identity. Both jobs check out `apache/spark-connect-rust` with `actions/checkout@v4` at its default `persist-credentials: true`, which stores the **built-in** `GITHUB_TOKEN` as a git `http.https://github.com/.extraheader`. That header overrides the `RELEASE_GITHUB_TOKEN` embedded in the subsequent ``` git push https://x-access-token:${RELEASE_GITHUB_TOKEN}@github.com/apache/spark-connect-rust.git refs/tags/<tag> ``` so the push authenticates as `github-actions[bot]` (which cannot write to apache) → 403. The `gh`-CLI release steps use the PAT via `GH_TOKEN` and were unaffected; only the two `git push` steps were hijacked. With `persist-credentials: false` no interfering `extraheader` is written, so the PAT-in-URL pushes authenticate as the token owner. No new secret is required. ### Does this PR introduce _any_ user-facing change? No — release tooling only. ### How was this patch tested? `actionlint` passes. The checkouts are of the public apache repo, so `persist-credentials: false` does not affect the read (checkout/artifacts); only the PAT-authenticated `git push` steps change identity. This pull request and its description were written by Isaac. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
