release: publish LabFox 0.1.1

.github/workflows/release.yml

@@ -155,6 +155,7 @@ jobs:
       - name: Tag the release
         env:
           TAG: ${{ needs.check.outputs.tag }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
@@ -166,7 +167,7 @@ jobs:
             echo "$TAG is already tagged on origin; keeping the published tag."
           else
             git tag -a "$TAG" -m "$TAG"
-            git push origin "refs/tags/$TAG"
+            git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')" push origin "refs/tags/$TAG"
           fi
 
       - name: Publish the GitHub release

apps/labfox/pubspec.yaml

@@ -1,6 +1,6 @@
 name: labfox
 description: A cross-platform GitLab workflow client.
-version: 0.1.0+2
+version: 0.1.1+3
 publish_to: none
 
 environment:

apps/labfox/test/release_workflow_security_test.dart

@@ -41,4 +41,29 @@ void main() {
       contains('persist-credentials: false'),
     );
   });
+
+  test(
+    'the release job authenticates the tag push without persisting a token',
+    () {
+      final contents = releaseWorkflow.readAsStringSync();
+
+      expect(
+        contents,
+        contains(
+          '      - name: Tag the release\n'
+          '        env:\n'
+          '          TAG: \${{ needs.check.outputs.tag }}\n'
+          '          GH_TOKEN: \${{ github.token }}',
+        ),
+      );
+      expect(
+        contents,
+        contains(
+          'git -c http.https://github.com/.extraheader='
+          '"AUTHORIZATION: basic \$(printf \'x-access-token:%s\' "\$GH_TOKEN" '
+          "| base64 | tr -d '\\n')\" push origin \"refs/tags/\$TAG\"",
+        ),
+      );
+    },
+  );
 }