docs: clarify fixed cache token behavior

- Remove token and cache-token from public action inputs
- Always use github.token internally for downloads/push
- Read fixed cache token from VOCIFERATE_CACHE_TOKEN env
- Add explicit 'Resolve cache token' step before prepare/tag in
  prepare-release workflow and pass it via env

.gitea/workflows/prepare-release.yml

@@ -38,13 +38,17 @@ jobs:
       - name: Run tests
         run: go test ./...
 
+      - name: Resolve cache token
+        id: cache-token
+        run: echo "value=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+
       - name: Prepare and tag release
         id: prepare
         uses: ./prepare
+        env:
+          VOCIFERATE_CACHE_TOKEN: ${{ steps.cache-token.outputs.value }}
         with:
           version: ${{ inputs.version }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          cache-token: ${{ github.sha }}
 
       - name: Summarize prepared release
         run: |

action.yml

@@ -2,10 +2,6 @@ name: vociferate
 description: Prepare release files or recommend a next semantic version tag.
 
 inputs:
-  token:
-    description: Optional token used to download the cached vociferate release binary. When omitted, the workflow token is used.
-    required: false
-    default: ''
   version:
     description: Optional semantic version override. When omitted, the recommended version is used.
     required: false
@@ -25,12 +21,6 @@ inputs:
     description: If true, print recommended next release tag.
     required: false
     default: 'false'
-  cache-token:
-    description: >
-      Optional fixed cache token used for the downloaded binary cache key.
-      Defaults to action repository plus release tag.
-    required: false
-    default: ''
 
 outputs:
   version:
@@ -48,10 +38,10 @@ runs:
       env:
         ACTION_REF: ${{ github.action_ref }}
         ACTION_REPOSITORY: ${{ github.action_repository }}
-        CACHE_TOKEN_INPUT: ${{ inputs.cache-token }}
+        CACHE_TOKEN: ${{ env.VOCIFERATE_CACHE_TOKEN }}
         SERVER_URL: ${{ github.server_url }}
         API_URL: ${{ github.api_url }}
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ github.token }}
         RUNNER_ARCH: ${{ runner.arch }}
         RUNNER_TEMP: ${{ runner.temp }}
       run: |
@@ -78,7 +68,7 @@ runs:
           binary_path="${cache_dir}/vociferate"
           asset_url="${SERVER_URL}/aether/vociferate/releases/download/${release_tag}/${asset_name}"
 
-          provided_cache_token="$(printf '%s' "${CACHE_TOKEN_INPUT:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+          provided_cache_token="$(printf '%s' "${CACHE_TOKEN:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
           if [[ -n "$provided_cache_token" ]]; then
             cache_token="$provided_cache_token"
           else
@@ -118,7 +108,7 @@ runs:
       if: steps.resolve-binary.outputs.use_binary == 'true' && steps.cache-vociferate.outputs.cache-hit != 'true'
       shell: bash
       env:
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ github.token }}
         ASSET_URL: ${{ steps.resolve-binary.outputs.asset_url }}
         BINARY_PATH: ${{ steps.resolve-binary.outputs.binary_path }}
       run: |

changelog.md

@@ -18,7 +18,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - `prepare/action.yml` accepts a `git-add-files` input so repositories using a custom `version-file` can stage the correct set of files for the release commit.
 - The `prepare-release.yml` and `do-release.yml` vociferate workflows now use the local `./prepare` and `./publish` actions, validating the actions in the self-release pipeline.
 - `prepare/action.yml` and `action.yml` use `go run ./cmd/vociferate` directly from the action source (via `GITHUB_ACTION_PATH`) when invoked at `@main`, and download a prebuilt binary when invoked at a semver tag. This makes development and CI on `main` self-contained without requiring a published release.
-- Binary download cache keys in published actions are now repository-scoped and support a fixed `cache-token` override. The local prepare-release workflow passes `github.sha` as the cache token, ensuring cache entries track this repository's produced binaries rather than colliding with similarly keyed caches from other repositories.
+- Binary download cache keys in published actions are now repository-scoped and use a workflow-defined fixed cache token (`github.sha` in this repository's prepare-release workflow). `cache-token` is no longer a public action input.
 
 - Release version recommendation now reads the current version from the most recent released section in the changelog instead of requiring a separate version file. When no prior releases exist the version defaults to `0.0.0`, yielding `v1.0.0` as the first recommended tag.
 - `vociferate prepare` creates the `release-version` file if it does not already exist, removing the need to pre-seed it in new repositories.

prepare/action.yml

@@ -4,12 +4,6 @@ description: >
   The repository must be checked out before this action runs.
 
 inputs:
-  token:
-    description: >
-      Token used to download the vociferate binary and to push the release
-      commit and tag. Defaults to the workflow token.
-    required: false
-    default: ''
   version:
     description: >
       Optional semantic version override (with or without leading v). When
@@ -48,12 +42,6 @@ inputs:
       custom version-file.
     required: false
     default: 'changelog.md release-version'
-  cache-token:
-    description: >
-      Optional fixed cache token used for the downloaded binary cache key.
-      Defaults to action repository plus release tag.
-    required: false
-    default: ''
 
 outputs:
   version:
@@ -70,10 +58,10 @@ runs:
       env:
         ACTION_REF: ${{ github.action_ref }}
         ACTION_REPOSITORY: ${{ github.action_repository }}
-        CACHE_TOKEN_INPUT: ${{ inputs.cache-token }}
+        CACHE_TOKEN: ${{ env.VOCIFERATE_CACHE_TOKEN }}
         SERVER_URL: ${{ github.server_url }}
         API_URL: ${{ github.api_url }}
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ github.token }}
         RUNNER_ARCH: ${{ runner.arch }}
         RUNNER_TEMP: ${{ runner.temp }}
       run: |
@@ -96,7 +84,7 @@ runs:
           binary_path="${cache_dir}/vociferate"
           asset_url="${SERVER_URL}/aether/vociferate/releases/download/${release_tag}/${asset_name}"
 
-          provided_cache_token="$(printf '%s' "${CACHE_TOKEN_INPUT:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+          provided_cache_token="$(printf '%s' "${CACHE_TOKEN:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
           if [[ -n "$provided_cache_token" ]]; then
             cache_token="$provided_cache_token"
           else
@@ -136,7 +124,7 @@ runs:
       if: steps.resolve-binary.outputs.use_binary == 'true' && steps.cache-vociferate.outputs.cache-hit != 'true'
       shell: bash
       env:
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ github.token }}
         ASSET_URL: ${{ steps.resolve-binary.outputs.asset_url }}
         BINARY_PATH: ${{ steps.resolve-binary.outputs.binary_path }}
       run: |
@@ -194,7 +182,7 @@ runs:
     - name: Commit and push release
       shell: bash
       env:
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ github.token }}
         GIT_USER_NAME: ${{ inputs.git-user-name }}
         GIT_USER_EMAIL: ${{ inputs.git-user-email }}
         GIT_ADD_FILES: ${{ inputs.git-add-files }}