fix: add -k to curl to bypass TLS verification in container

Also ensure RELEASER_TOKEN secret is set in Woodpecker. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>
fix: use RELEASER_TOKEN for Gitea API auth instead of droneci password
2026-03-26 13:43:05 +11:00 · 2026-03-26 13:38:21 +11:00
1 changed files with 8 additions and 8 deletions
@@ -17,8 +17,8 @@ steps:
  - name: release
    image: git.unkin.net/unkin/almalinux9-base:20260325
    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
+      RELEASER_TOKEN:
+        from_secret: RELEASER_TOKEN
    commands:
      - |
        PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
@@ -28,20 +28,20 @@ steps:
          NOTES=$(git log --merges --pretty=format:"- %s")
        fi
        BODY=$(printf '%s' "$NOTES" | sed 's/"/\\"/g; s/$/\\n/' | tr -d '\n')
-        GET_RESPONSE=$(curl -s "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/tags/${CI_COMMIT_TAG}")
+        GET_RESPONSE=$(curl -sk "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/tags/${CI_COMMIT_TAG}")
        echo "GET response: ${GET_RESPONSE}"
-        RELEASE_ID=$(echo "${GET_RESPONSE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+        RELEASE_ID=$(printf '%s' "${GET_RESPONSE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
        if [ -z "$RELEASE_ID" ]; then
          echo "ERROR: failed to find release for tag ${CI_COMMIT_TAG}" >&2
          exit 1
        fi
        echo "Release ID: ${RELEASE_ID}"
-        curl -s -X PATCH "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}" \
-          -u "droneci:$DRONECI_PASSWORD" \
+        curl -sk -X PATCH "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}" \
+          -H "Authorization: token ${RELEASER_TOKEN}" \
          -H "Content-Type: application/json" \
          -d "{\"body\":\"${BODY}\"}"
-        curl -s -X POST "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}/assets" \
-          -u "droneci:$DRONECI_PASSWORD" \
+        curl -sk -X POST "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}/assets" \
+          -H "Authorization: token ${RELEASER_TOKEN}" \
          -F "attachment=@node-lookup"
    backend_options:
      kubernetes:
Author	SHA1	Message	Date
unkinben	6e7f65d6cc	fix: add -k to curl to bypass TLS verification in container ci/woodpecker/pr/lint Pipeline failed Details ci/woodpecker/pr/unit-tests Pipeline failed Details ci/woodpecker/pr/pre-commit Pipeline failed Details Also ensure RELEASER_TOKEN secret is set in Woodpecker. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>	2026-03-26 13:43:05 +11:00
unkinben	96179ed63c	fix: use RELEASER_TOKEN for Gitea API auth instead of droneci password ci/woodpecker/pr/lint Pipeline was successful Details ci/woodpecker/pr/unit-tests Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details droneci user lacks write access; switch to token-based auth header. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>	2026-03-26 13:38:21 +11:00