Repository navigation
fix: remove the unused release workflow - #304
Merged
Merged
Conversation
The release workflow configured git to rewrite GitHub URLs with a classic PAT so that Go could authenticate when fetching private modules. There are no private modules to fetch: - go.mod/go.sum have exactly one Kong dependency, github.com/kong/go-slugify, which is public and served by proxy.golang.org. - .goreleaser.yml sets `release: skip_upload: true`, so GoReleaser publishes nothing requiring elevated auth. The job's only credential need is the built-in secrets.GITHUB_TOKEN, already passed to the GoReleaser step. The step dates back to 4d55c49 ("Add goreleaser", Jan 2023) and appears to have been boilerplate from the initial setup rather than a response to an actual private dependency. Verified with a clean module cache and no credentials in the environment: `go mod download all` succeeds via the public proxy, and `GOPROXY=direct` (which forces the real git clone the rewrite existed to authenticate) also succeeds. Release-flag build passes. Part of SEI-64, which removes kong-apiops classic PAT usage ahead of the enterprise-wide 7-day token lifetime cap. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #304 +/- ##
=======================================
Coverage 58.82% 58.82%
=======================================
Files 36 36
Lines 3869 3869
=======================================
Hits 2276 2276
Misses 1380 1380
Partials 213 213 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
manishsvk
changed the title
manishsvk
marked this pull request as draft
October 19, 2026 04:06
| @@ -17,10 +17,6 @@ jobs: | |||
| with: | |||
Contributor
There was a problem hiding this comment.
@manishsvk since we haven't been using this workflow, can we remove the workflow itself?
cc: @mheap is the release workflow in go-apiops still needed?
Contributor
Author
There was a problem hiding this comment.
@harshadixit12 - yes, let us remove the workflow itself.
manishsvk
marked this pull request as ready for review
October 19, 2026 04:16
Follow-up to the previous commit, per review feedback: rather than just dropping the unused PAT git config, remove the whole release workflow. The workflow has never produced a release: - All 11 recorded runs have failed, going back to v0.2.1 (Nov 2025). GoReleaser itself exits 1; the most recent failure was on v0.4.6. - Published GitHub releases carry 0 assets, so releases are being created by other means and this workflow contributes nothing. - .goreleaser.yml sets `release: skip_upload: true`, so even a green run would upload nothing. Removing it also resolves the last secrets.PAT reference in the repo, which was the original goal of SEI-64 (ahead of the enterprise-wide 7-day classic PAT lifetime cap). .goreleaser.yml is intentionally left in place so that local snapshot builds (`goreleaser release --snapshot --clean`) keep working. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
manishsvk
changed the title
harshadixit12
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes
.github/workflows/release.yamlentirely.This was originally scoped to deleting just the unused
secrets.PATgit config step. Per @harshadixit12's review, the whole workflow goes instead — it isn't used.Why
Part of SEI-64 — Security is enforcing a 7-day maximum lifetime on classic GitHub PATs enterprise-wide, and
kong-apiops' tokens need to come off the critical path first. This workflow held the onlysecrets.PATreference in the repo, so removing it closes the SEI-64 item forgo-apiopsoutright.The workflow has never produced a release:
v0.2.1(Nov 2025)v0.4.6, GoReleaser exits 1So releases are being created by other means, and this workflow contributes nothing. It can't be "fixed" by this PR either: the original PAT step was unrelated to the failures (the repo has no private Go modules — its one Kong dependency,
github.com/kong/go-slugify, is public and served byproxy.golang.org).