Make release automation resilient to token expiry

.github/workflows/package-win.yml

@@ -37,7 +37,7 @@ jobs:
         id: get_tag
         shell: pwsh
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ inputs.tag_name }}"
           if (-not $TAG) { $TAG = "${{ github.event.release.tag_name }}" }
@@ -57,7 +57,7 @@ jobs:
 
       - name: Download Release Assets
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ steps.get_tag.outputs.tag }}"
           $Version = "${{ steps.get_version.outputs.version }}"
@@ -268,7 +268,7 @@ jobs:
 
       - name: Upload Installer to Release
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ steps.get_tag.outputs.tag }}"
           $Version = "${{ steps.get_version.outputs.version }}"

.github/workflows/package.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Upload to release
         if: github.event_name == 'release' || github.event.inputs.release_tag
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
           install -m 0644 "${{ steps.find-deb.outputs.path }}" \
@@ -140,7 +140,7 @@ jobs:
       - name: Upload to release
         if: github.event_name == 'release' || github.event.inputs.release_tag
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
           install -m 0644 "${{ steps.find-rpm.outputs.path }}" \
@@ -163,6 +163,8 @@ jobs:
           GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
-          gh api --method POST repos/xxanqw/apt-repository/dispatches \
+          if ! gh api --method POST repos/xxanqw/apt-repository/dispatches \
             --raw-field event_type=new-release \
-            --field "client_payload[tag_name]=$RELEASE_TAG"
+            --field "client_payload[tag_name]=$RELEASE_TAG"; then
+            echo "::warning::Could not dispatch apt-repository; its daily schedule will publish the release. Check RELEASE_TOKEN if immediate updates are required."
+          fi

.github/workflows/release.yml

@@ -256,9 +256,10 @@ jobs:
         GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         RELEASE_TAG: v${{ needs.extract-version.outputs.version }}
       run: |
-        gh api --method POST repos/xxanqw/scoop-bucket/dispatches \
-          --raw-field event_type=new-release \
-          --field "client_payload[tag_name]=$RELEASE_TAG"
-        gh api --method POST repos/xxanqw/homebrew-mikusays/dispatches \
-          --raw-field event_type=new-release \
-          --field "client_payload[tag_name]=$RELEASE_TAG"
+        for repository in xxanqw/scoop-bucket xxanqw/homebrew-mikusays; do
+          if ! gh api --method POST "repos/$repository/dispatches" \
+            --raw-field event_type=new-release \
+            --field "client_payload[tag_name]=$RELEASE_TAG"; then
+            echo "::warning::Could not dispatch $repository; its four-hour schedule will pick up the release. Check RELEASE_TOKEN if immediate updates are required."
+          fi
+        done

README.md

@@ -105,7 +105,9 @@ Tagged releases build the platform binaries first, then trigger the Scoop bucket
 After all DEB and RPM assets have uploaded, the package workflow triggers the APT/RPM
 repository with the exact tag. The `RELEASE_TOKEN` Actions secret must be able to create
 repository dispatch events in `xxanqw/scoop-bucket`, `xxanqw/homebrew-mikusays`, and
-`xxanqw/apt-repository`.
+`xxanqw/apt-repository`. If that token expires, the release remains successful and the
+downstream repositories recover through their scheduled update workflows. Uploads to the
+MikuSays release itself use the built-in workflow token and do not depend on this secret.
 
 The distribution repositories keep scheduled and manual workflows as recovery paths if
 an event dispatch fails.