From 0324a92037f1c830fa1c9e440024211d423dbea5 Mon Sep 17 00:00:00 2001
From: Ivan Potiienko <potik217@gmail.com>
Date: Mon, 31 Aug 2026 22:28:13 +0200
Subject: [PATCH] Make release automation resilient to token expiry

---
 .github/workflows/package-win.yml |  6 +++---
 .github/workflows/package.yml     | 10 ++++++----
 .github/workflows/release.yml     | 13 +++++++------
 README.md                         |  4 +++-
 4 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/package-win.yml b/.github/workflows/package-win.yml
index 4a7a9cf..53ea743 100644
--- a/.github/workflows/package-win.yml
+++ b/.github/workflows/package-win.yml
@@ -37,7 +37,7 @@ jobs:
         id: get_tag
         shell: pwsh
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ inputs.tag_name }}"
           if (-not $TAG) { $TAG = "${{ github.event.release.tag_name }}" }
@@ -57,7 +57,7 @@ jobs:
 
       - name: Download Release Assets
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ steps.get_tag.outputs.tag }}"
           $Version = "${{ steps.get_version.outputs.version }}"
@@ -268,7 +268,7 @@ jobs:
 
       - name: Upload Installer to Release
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           $TAG = "${{ steps.get_tag.outputs.tag }}"
           $Version = "${{ steps.get_version.outputs.version }}"
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index c34080b..7c1867c 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Upload to release
         if: github.event_name == 'release' || github.event.inputs.release_tag
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
           install -m 0644 "${{ steps.find-deb.outputs.path }}" \
@@ -140,7 +140,7 @@ jobs:
       - name: Upload to release
         if: github.event_name == 'release' || github.event.inputs.release_tag
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
           install -m 0644 "${{ steps.find-rpm.outputs.path }}" \
@@ -163,6 +163,8 @@ jobs:
           GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release_tag }}
         run: |
-          gh api --method POST repos/xxanqw/apt-repository/dispatches \
+          if ! gh api --method POST repos/xxanqw/apt-repository/dispatches \
             --raw-field event_type=new-release \
-            --field "client_payload[tag_name]=$RELEASE_TAG"
+            --field "client_payload[tag_name]=$RELEASE_TAG"; then
+            echo "::warning::Could not dispatch apt-repository; its daily schedule will publish the release. Check RELEASE_TOKEN if immediate updates are required."
+          fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 46d410d..8ed17a4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -256,9 +256,10 @@ jobs:
         GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         RELEASE_TAG: v${{ needs.extract-version.outputs.version }}
       run: |
-        gh api --method POST repos/xxanqw/scoop-bucket/dispatches \
-          --raw-field event_type=new-release \
-          --field "client_payload[tag_name]=$RELEASE_TAG"
-        gh api --method POST repos/xxanqw/homebrew-mikusays/dispatches \
-          --raw-field event_type=new-release \
-          --field "client_payload[tag_name]=$RELEASE_TAG"
+        for repository in xxanqw/scoop-bucket xxanqw/homebrew-mikusays; do
+          if ! gh api --method POST "repos/$repository/dispatches" \
+            --raw-field event_type=new-release \
+            --field "client_payload[tag_name]=$RELEASE_TAG"; then
+            echo "::warning::Could not dispatch $repository; its four-hour schedule will pick up the release. Check RELEASE_TOKEN if immediate updates are required."
+          fi
+        done
diff --git a/README.md b/README.md
index 81f3e15..a182761 100644
--- a/README.md
+++ b/README.md
@@ -105,7 +105,9 @@ Tagged releases build the platform binaries first, then trigger the Scoop bucket
 After all DEB and RPM assets have uploaded, the package workflow triggers the APT/RPM
 repository with the exact tag. The `RELEASE_TOKEN` Actions secret must be able to create
 repository dispatch events in `xxanqw/scoop-bucket`, `xxanqw/homebrew-mikusays`, and
-`xxanqw/apt-repository`.
+`xxanqw/apt-repository`. If that token expires, the release remains successful and the
+downstream repositories recover through their scheduled update workflows. Uploads to the
+MikuSays release itself use the built-in workflow token and do not depend on this secret.
 
 The distribution repositories keep scheduled and manual workflows as recovery paths if
 an event dispatch fails.