ci(release): keep the publish job's write token out of its checkout and environment

.github/workflows/release.yml

@@ -148,12 +148,12 @@ jobs:
     permissions:
       contents: write
     env:
-      GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}
     steps:
       - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
+          persist-credentials: false
       - uses: actions/download-artifact@v8
         with:
           pattern: release-*
@@ -172,11 +172,15 @@ jobs:
           chmod +x "dist/relinker-$RELEASE_TAG"
       - name: Prepare release notes
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh api --method POST "repos/$GH_REPO/releases/generate-notes" -f tag_name="$RELEASE_TAG" > "$RUNNER_TEMP/release-notes.json"
           python tools/prepare_release_notes.py --input "$RUNNER_TEMP/release-notes.json" --body "$RUNNER_TEMP/release-body.md" --full dist/release-notes.md
       - name: Create or refresh draft and upload files
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           release_marker="<!-- anyps5-release-workflow:$GITHUB_SHA -->"
           printf '\n%s\n' "$release_marker" >> "$RUNNER_TEMP/release-body.md"
@@ -213,4 +217,6 @@ jobs:
             exit 1
           fi
       - name: Publish complete release
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: gh release edit "$RELEASE_TAG" --draft=false

CMakeLists.txt

@@ -263,6 +263,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_audit_dump.py)
         add_test(NAME ffmpeg_cache_keys COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_ffmpeg_cache_keys.py)
+        add_test(NAME release_workflow COMMAND ${Python3_EXECUTABLE} ${CMAKE_SOURCE_DIR}/tools/tests/test_release_workflow.py)
+        set_tests_properties(release_workflow PROPERTIES TIMEOUT 20)
         foreach(shard RANGE 0 11)
             if(shard EQUAL 0)
                 set(conventions_test_name conventions_function_bodies)

tools/tests/test_release_workflow.py

@@ -0,0 +1,23 @@
+import unittest
+from pathlib import Path
+
+WORKFLOW = Path(__file__).resolve().parents[2] / ".github/workflows/release.yml"
+
+
+def publish_job():
+    return WORKFLOW.read_text(encoding="utf-8").split("\n  publish:\n", 1)[1]
+
+
+class PublishJobTests(unittest.TestCase):
+    def test_checkout_keeps_no_credentials(self):
+        job = publish_job()
+        checkout = job.split("      - uses: actions/checkout@v7", 1)[1].split("      - uses:", 1)[0]
+        self.assertIn("persist-credentials: false", checkout)
+
+    def test_write_token_is_not_in_the_job_environment(self):
+        job_environment = publish_job().split("    env:\n", 1)[1].split("    steps:", 1)[0]
+        self.assertNotIn("GH_TOKEN", job_environment)
+
+
+if __name__ == "__main__":
+    unittest.main()