🔴 Release Pipeline Failed — ce5abac

[github-actions]

Release Pipeline Failed

Field	Value
Workflow	🚀 UFFS Release Pipeline
Run	#135
Branch	refs/heads/main
Commit	ce5abac
Triggered by	@github-actions[bot]

⚠️ This is a release pipeline failure — immediate attention required.

📧 Notification sent to: releasefail@uffs.io

[github-actions]

Release Pipeline Failed

Field	Value
Workflow	🚀 UFFS Release Pipeline
Run	#135
Branch	refs/heads/main
Commit	ce5abac
Triggered by	@github-actions[bot]

⚠️ This is a release pipeline failure — immediate attention required.

📧 Notification sent to: releasefail@uffs.io

[githubrobbi]

✅ Resolved — v0.6.14 published

Root cause (diagnosed via cli/cli#9514): action-gh-release's POST /releases with a commit-SHA target_commitish returns 403 "Resource not accessible by integration" under the GITHUB_TOKEN integration (began ~2026-06; PATs unaffected — which is why the bot failed while a user token worked). Repo/org settings, workflow permissions (the job token had Contents: write), and rulesets were all verified permissive; it was the API endpoint, not config. All three binaries had built fine — only the publish step 403'd.

Fix: #478 — create the tag ref at the built commit via POST /git/refs (immune to both the workflow-file push guard and the release-with-target 403), then attach the release to the now-existing tag with no target_commitish. No PAT required; least-privilege GITHUB_TOKEN; build-commit pinning preserved; GITHUB_TOKEN-created tag doesn't re-trigger the workflow.

Outcome: v0.6.14 re-dispatched on the fixed pipeline (run #28244740846) → published with all 44 assets incl. SHA256SUMS. Future releases use the same path, so this won't recur.

Closing.