GITHUB_SHA (github.sha) reflects the workflow trigger commit, which is the main HEAD before the prepare job ran. The tag itself points to the release commit created by prepare — a different SHA. Gitea rejects PATCH and POST with 403 when target_commitish doesn't match the tag's commit. Use git rev-list -n 1 TAG to resolve the exact SHA the tag points to, ensuring the target field is always correct regardless of when or how the release workflow is called.
6.1 KiB
6.1 KiB