From 4a2d234ba3b21841473e17e52ab1bba44fe73a15 Mon Sep 17 00:00:00 2001
From: Micheal Wilkinson <micheal.wilkinson@createfuture.com>
Date: Sat, 21 Mar 2026 19:46:53 +0000
Subject: [PATCH] fix(publish): stop sending target field in release payload

Prepare already creates and pushes the release tag, so publish should not
retarget it. Sending target can trigger 403 on Gitea when tag retargeting
is restricted. Build PATCH/POST payloads from tag_name + notes only.
---
 publish/action.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/publish/action.yml b/publish/action.yml
index 134eaea..f92343c 100644
--- a/publish/action.yml
+++ b/publish/action.yml
@@ -104,12 +104,6 @@ runs:
           exit 1
         fi
 
-        # Resolve the exact commit SHA the tag points to. Using git rev-list
-        # rather than github.sha avoids the common mismatch where the workflow
-        # was triggered from a pre-release commit but the tag was created on
-        # the subsequent release commit by the prepare job.
-        tag_sha="$(git rev-list -n 1 "${TAG_NAME}")"
-
         release_notes="$(cat "$RELEASE_NOTES_FILE")"
         escaped_release_notes="$(printf '%s' "$release_notes" | sed 's/\\/\\\\/g; s/"/\\"/g; :a;N;$!ba;s/\n/\\n/g')"
         release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases"
@@ -133,7 +127,7 @@ runs:
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             "${release_api}/${existing_release_id}" \
-            --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${tag_sha}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
+            --data "{\"tag_name\":\"${TAG_NAME}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
             --output release.json
 
           echo "id=$existing_release_id" >> "$GITHUB_OUTPUT"
@@ -147,7 +141,7 @@ runs:
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             "${release_api}" \
-            --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${tag_sha}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
+            --data "{\"tag_name\":\"${TAG_NAME}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
             --output release.json
 
           release_id="$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' release.json | head -n 1)"